Vulnerability · Published Jul 16, 2025 · Assigned by VulnCheck

CVE-2025-34117Netcore / Netis Routers RCE via UDP Port 53413 Backdoor

Critical 9.3

In plain English

A critical-severity missing authentication in Router firmware from Netcore Technology. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 20.8% (higher than 98% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit.

Severity (CVSS 4.0)9.3Critical

Exploit odds (30 days)20.8%top 2.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack tooling1Metasploit

Official description

A remote code execution vulnerability exists in multiple Netcore and Netis routers models with firmware released prior to August 2014 due to the presence of an undocumented backdoor listener on UDP port 53413. Exact version boundaries remain undocumented. An unauthenticated remote attacker can send specially crafted UDP packets to execute arbitrary commands on the affected device. This backdoor uses a hardcoded authentication mechanism and accepts shell commands post-authentication. Some device models include a non-standard implementation of the `echo` command, which may affect exploitability.

Affected products (as reported)

Vendor	Product	Versions
Netcore Technology	Router firmware	Prior to August 2014
Netis	Router firmware	Prior to August 2014

Weakness: CWE-912, CWE-306, CWE-78 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

https://web.archive.org/web/20140828114943/http://blog.trendmicro.com/trendlabs-security-intelligence/netis-routers-leave-wide-open-backdoor/ third-party-advisory, technical-description
https://www.seebug.org/vuldb/ssvid-90227 third-party-advisory, technical-description
https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/misc/netcore_udp_53413_backdoor.rb exploit
https://www.shadowserver.org/what-we-do/network-reporting/netcore-netis-router-vulnerability-scan-report/ third-party-advisory
https://vulners.com/metasploit/MSF:EXPLOIT-LINUX-MISC-NETCORE_UDP_53413_BACKDOOR- third-party-advisory, exploit
https://www.vulncheck.com/advisories/netcore-netis-routers-backdoor-rce third-party-advisory
https://www.exploit-db.com/exploits/43387 exploit