CVE-2025-66848

Published: Dec 30, 2025Modified: Jan 9, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

JD Cloud NAS routers AX1800 (4.3.1.r4308 and earlier), AX3000 (4.3.1.r4318 and earlier), AX6600 (4.5.1.r4533 and earlier), BE6500 (4.4.1.r4308 and earlier), ER1 (4.5.1.r4518 and earlier), and ER2 (4.5.1.r4518 and earlier) contain an unauthorized remote command execution vulnerability.

Affected (6)

Products: Jdcloud: Ax1800 Firmware, Ax3000 Firmware, Ax6600 Firmware, Be6500 Firmware, Er1 Firmware, Er2 Firmware

6 products

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Jdcloud Ax1800 Firmware	Up to 4.3.1.r4308

Running on/with	Platform Versions
Jdcloud Ax1800	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Jdcloud Ax3000 Firmware	Up to 4.3.1.r4318

Running on/with	Platform Versions
Jdcloud Ax3000	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Jdcloud Ax6600 Firmware	Up to 4.5.1.r4533

Running on/with	Platform Versions
Jdcloud Ax6600	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Jdcloud Be6500 Firmware	Up to 4.4.1.r4308

Running on/with	Platform Versions
Jdcloud Be6500	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Jdcloud Er1 Firmware	Up to 4.5.1.r4518

Running on/with	Platform Versions
Jdcloud Er1	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Jdcloud Er2 Firmware	Up to 4.5.1.r4518

Running on/with	Platform Versions
Jdcloud Er2	All versions

Related CWEs

CWE-94

Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

References (3)

http://jd.com

Source: cve@mitre.org

Not Applicable

https://www.notion.so/JD-Cloud-Unauth-RCE-2d22b76e8e0c802c975bf186b208d0c2

Source: cve@mitre.org

Permissions Required

https://www.jdcloud.com/cn/

Source: nvd@nist.gov

Product

Timeline

No history available yet.