Vulnerability · Published Jan 30, 2025 · Assigned by icscert
CVE-2025-0680New Rock Technologies Cloud Connected Devices has a Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability.
Critical 9.8
In plain English
A critical-severity OS command injection in MX8G VoIP Gateway from New Rock Technologies. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 51% of all known vulnerabilities).
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)0.6%top 49.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Affected products contain a vulnerability in the device cloud rpc command handling process that could allow remote attackers to take control over arbitrary devices connected to the cloud.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| New Rock Technologies | OM500 IP-PBX | All |
| New Rock Technologies | MX8G VoIP Gateway | All |
| New Rock Technologies | NRP1302/P Desktop IP Phone | All |
Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H