Vulnerability · Published Nov 27, 2025 · Assigned by CERT-PL
CVE-2025-8890Authenticated RCE in SDMC NE6037 router
Critical 9.3
In plain English
A critical-severity OS command injection in NE6037 from SDMC. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 73% of all known vulnerabilities).
Severity (CVSS 4.0)9.3Critical
Exploit odds (30 days)1.4%top 27.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Firmware in SDMC NE6037 routers prior to version 7.1.12.2.44 has a network diagnostics tool vulnerable to a shell command injection attacks. In order to exploit this vulnerability, an attacker has to log in to the router's administrative portal, which by default is reachable only via LAN ports.
Affected products (as reported)
Weakness: CWE-78 · Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
References
- https://cert.pl/en/posts/2025/11/CVE-2025-8890 third-party-advisory
- https://www.securitum.com/cve-2025-8890.html technical-description