PT-2025-53404 · Jd Cloud · Jd Cloud Be6500

Sta8R9 · Published 2025-12-25 · Updated 2025-12-25 · CVE-2025-15081

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions JD Cloud BE6500 version 4.4.1.r4308

Description A command injection issue exists in JD Cloud BE6500 version 4.4.1.r4308. The issue is located in the /jdcapi file and affects the sub 4780 function. Manipulation of the ddns name argument can lead to command injection, and the attack can be performed remotely. The exploit for this issue has been publicly disclosed.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Special Elements Injection

Command Injection

Weakness Enumeration

CWE-74

CWE-77

Related Identifiers

CVE-2025-15081

Affected Products

Jd Cloud Be6500

References · 9

• 🔥 https://gist.github.com/isstabber/4ed3554130681e50b3e987c3c4ee1f29 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-15081 · Security Note
• https://vuldb.com/?id.338409 · Note
• https://twitter.com/VulmonFeeds/status/2004217815214023014 · Twitter Post
• https://t.me/cveNotify/146828 · Telegram Post
• https://t.me/CVEtracker/40663 · Telegram Post
• https://vuldb.com/?ctiid.338409 · Note
• https://twitter.com/CVEnew/status/2004294847880970613 · Twitter Post
• https://vuldb.com/?submit.707276 · Note