PT-2025-29880 · Unknown · Netcore Routers+1

H00Die + 1 · Published 2025-07-16 · Updated 2025-07-17 · CVE-2025-34117

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Netcore and Netis routers (affected versions not specified)

Description A remote code execution issue exists due to an undocumented backdoor listener on UDP port 53413. An unauthenticated remote attacker can send specially crafted UDP packets to execute arbitrary commands on the affected device. The backdoor uses a hardcoded authentication mechanism and accepts shell commands post-authentication. Some device models include a non-standard implementation of the echo command, which may affect exploitability.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Missing Authentication

Hidden Functionality

OS Command Injection

Weakness Enumeration

CWE-306

CWE-912

CWE-78

Related Identifiers

CVE-2025-34117

Affected Products

Netcore Routers

Netis Routers

References · 11

• 🔥 https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/misc/netcore_udp_53413_backdoor.rb · Exploit
• 🔥 https://vulners.com/metasploit/MSF:EXPLOIT-LINUX-MISC-NETCORE_UDP_53413_BACKDOOR- · Exploit
• 🔥 https://exploit-db.com/exploits/43387 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-34117 · Security Note
• https://twitter.com/CVEnew/status/1945598206257025260 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1945691694868955613 · Twitter Post
• https://shadowserver.org/what-we-do/network-reporting/netcore-netis-router-vulnerability-scan-report · Note
• https://web.archive.org/web/20140828114943/http://blog.trendmicro.com/trendlabs-security-intelligence/netis-routers-leave-wide-open-backdoor · Note
• https://seebug.org/vuldb/ssvid-90227 · Note
• https://vulncheck.com/advisories/netcore-netis-routers-backdoor-rce · Note
• https://t.me/cvetracker/28002 · Telegram Post