CVE-2025-0680

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Affected products contain a vulnerability in the device cloud rpc command handling process that could allow remote attackers to take control over arbitrary devices connected to the cloud.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

VendorProductVersions
New Rock TechnologiesOM500 IP-PBXAll
New Rock TechnologiesMX8G VoIP GatewayAll
New Rock TechnologiesNRP1302/P Desktop IP PhoneAll

References

Timeline

Published
Jan 30, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-06816.2The Cloud MQTT service of the affected products supports wildcard topic subscription which could allow an attacker to obtain sensitive infCVE-2025-06828.8The ThemeREX Addons plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.33.0 via the 'trx_sc_CVE-2025-06835.9In its default configuration, Contec Health CMS8000 Patient Monitor transmits plain-text patient data to a hard-coded public IP address wheCVE-2025-06846.4A flaw was found in grub2. When performing a symlink lookup from a reiserfs filesystem, grub's reiserfs fs module uses user-controlled paramCVE-2025-06856.4A flaw was found in grub2. When reading data from a jfs filesystem, grub's jfs filesystem module uses user-controlled parameters from the fiCVE-2025-06866.4A flaw was found in grub2. When performing a symlink lookup from a romfs filesystem, grub's romfs filesystem module uses user-controlled parCVE-2025-06876.1The Spiritual Gifts Survey (and optional S.H.A.P.E survey) WordPress plugin through 0.9.10 does not sanitise and escape a parameter before oCVE-2025-06886.1The Spiritual Gifts Survey (and optional S.H.A.P.E survey) WordPress plugin through 0.9.10 does not sanitise and escape a parameter before oCVE-2025-06897.8When reading data from disk, the grub's UDF filesystem module utilizes the user controlled data length metadata to allocate its internal bufCVE-2025-06906.1The read command is used to read the keyboard input from the user, while reads it keeps the input length in a 32-bit integer value which is CVE-2025-06915.0Improper access control in permissions component in Devolutions Server 2025.1.10.0 and earlier allows an authenticated user to bypass the "ECVE-2025-06923.5The Simple Video Management System WordPress plugin through 1.0.4 does not sanitise and escape some of its settings, which could allow high
CVE-2025-0680: Critical severity, CVSS 9.8 | Vulnix