JD Cloud Router CVE-2025-66848

Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication or user interaction is required and the attack is low-complexity against affected firmware builds, matching the description's 'unauthorized remote command execution.' The concrete prerequisite is network reachability to the vulnerable management/backend service on a device running a listed vulnerable firmware version (e.g., AX1800 ≤ 4.3.1.r4308, ER1/ER2 ≤ 4.5.1.r4518). The primary limiting factor is exposure of that service: the description does not name the specific injectable endpoint or protocol, so exploitation likely requires the attacker to be on the same LAN or for remote management to be enabled to reach it from the WAN - verify the management-interface exposure model with the vendor, as this determines whether the threat is internet-wide or LAN-adjacent.

The signals are mostly aligned toward high priority but not fully corroborated by exploitation telemetry. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) describes the worst-case profile: network reachable, low complexity, no privileges, no user interaction, with full confidentiality, integrity and availability impact. Against that, EPSS is only 1.01% (59th percentile) - modest, which is common for freshly published CVEs on niche vendor hardware before exploit tooling matures. This CVE is NOT listed in CISA KEV and no public POC has been identified, so the 9.8 rating currently reflects potential rather than demonstrated mass exploitation. The description does not specify WHICH service or parameter is injectable, so although 'unauthorized RCE' supports PR:N, the exact reachability (LAN-only vs. WAN-exposed management interface) is unverified - a material caveat, since router command-injection bugs are frequently only exploitable from the LAN side or when remote management is enabled. Verify exposure of the management interface with the vendor before treating this as internet-wide.

An attacker who can reach the router's management/web service sends a crafted request containing shell metacharacters into a vulnerable parameter, causing the device to execute attacker-supplied commands as a privileged system user. With code execution on the router, the attacker installs persistent malware, captures or redirects traffic, and pivots into the LAN behind it. No public exploit code has been identified, but the low attack complexity means one could be developed quickly once the vulnerable endpoint is disclosed.