CVE-2025-33024

CriticalCVSS 9.9/10Last modified Jun 17, 2026

Description

A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.5), RUGGEDCOM ROX MX5000RE (All versions < V2.16.5), RUGGEDCOM ROX RX1400 (All versions < V2.16.5), RUGGEDCOM ROX RX1500 (All versions < V2.16.5), RUGGEDCOM ROX RX1501 (All versions < V2.16.5), RUGGEDCOM ROX RX1510 (All versions < V2.16.5), RUGGEDCOM ROX RX1511 (All versions < V2.16.5), RUGGEDCOM ROX RX1512 (All versions < V2.16.5), RUGGEDCOM ROX RX1524 (All versions < V2.16.5), RUGGEDCOM ROX RX1536 (All versions < V2.16.5), RUGGEDCOM ROX RX5000 (All versions < V2.16.5). The 'tcpdump' tool in the web interface of affected devices is vulnerable to command injection due to missing server side input sanitation. This could allow an authenticated remote attacker to execute arbitrary code with root privileges.

Metrics

CVSS 3.1 9.9/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-602

Affected software

No affected versions have been published.

Timeline

Published: May 13, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-330259.9A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.5), RUGGEDCOM ROX MX5000RE (All versions < V2.16.5), RUGGE CVE-2025-330267.8In PeaZip through 10.4.0, there is a Mark-of-the-Web Bypass Vulnerability. This vulnerability allows attackers to bypass the Mark-of-the-Web CVE-2025-330277.8In Bandisoft Bandizip through 7.37, there is a Mark-of-the-Web Bypass Vulnerability. This vulnerability allows attackers to bypass the Mark-CVE-2025-330286.1In WinZip through 29.0, there is a Mark-of-the-Web Bypass Vulnerability because of an incomplete fix for CVE-2024-8811. This vulnerability a CVE-2025-330297.4Out-of-bounds write for some Intel(R) PROSet/Wireless WiFi Software for Windows before version 23.160 within Ring 2: Device Drivers may allo CVE-2025-33037.5A vulnerability, which was classified as critical, has been found in code-projects Patient Record Management System 1.0. Affected by this is CVE-2025-330303.3Improper conditions check in some firmware for some Intel(R) NPU Drivers within Ring 3: User Applications may allow an escalation of privile CVE-2025-330318.8An improper certificate validation vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they CVE-2025-330324.9A path traversal vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrat CVE-2025-330336.5A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit t CVE-2025-330346.5A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit t CVE-2025-330356.5A path traversal vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit