CVE-2025-66848: Jdcloud Ax1800 Firmware RCE Vulnerability

CVE-2025-66848 Overview

CVE-2025-66848 is an unauthorized remote command execution vulnerability affecting multiple JD Cloud NAS router models. The vulnerability allows unauthenticated attackers to execute arbitrary commands on affected devices over the network, potentially leading to complete device compromise.

This firmware-level vulnerability affects the entire JD Cloud NAS router product line, including consumer Wi-Fi 6 routers and enterprise network devices. The flaw enables remote attackers to gain full control of vulnerable routers without any prior authentication, making it particularly dangerous for exposed network infrastructure.

Critical Impact

Unauthenticated remote command execution allows attackers to fully compromise JD Cloud NAS routers, potentially enabling network pivoting, data interception, and persistent backdoor installation.

Affected Products

• JD Cloud AX1800 (firmware version 4.3.1.r4308 and earlier)
• JD Cloud AX3000 (firmware version 4.3.1.r4318 and earlier)
• JD Cloud AX6600 (firmware version 4.5.1.r4533 and earlier)
• JD Cloud BE6500 (firmware version 4.4.1.r4308 and earlier)
• JD Cloud ER1 (firmware version 4.5.1.r4518 and earlier)
• JD Cloud ER2 (firmware version 4.5.1.r4518 and earlier)

Discovery Timeline

• 2025-12-30 - CVE-2025-66848 published to NVD
• 2026-01-09 - Last updated in NVD database

Technical Details for CVE-2025-66848

Vulnerability Analysis

This vulnerability is classified under CWE-94 (Improper Control of Generation of Code - Code Injection). The flaw exists in the firmware of JD Cloud NAS routers, which fails to properly validate and sanitize input before processing commands. This allows an unauthenticated remote attacker to inject and execute arbitrary commands on the underlying operating system.

The network-accessible nature of this vulnerability combined with the lack of authentication requirements makes it exploitable by any attacker who can reach the router's management interface. Successful exploitation grants the attacker complete control over the device, including the ability to modify network configurations, intercept traffic, and use the compromised router as a pivot point for further attacks on the internal network.

Root Cause

The root cause is improper input validation in the router's command processing functionality. The firmware does not adequately sanitize user-supplied input before passing it to system command execution functions, resulting in a code injection vulnerability. This is a common issue in embedded device firmware where security controls may be lacking due to resource constraints or development oversights.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability remotely by sending specially crafted requests to the router's management interface. The vulnerability can be exploited from the local network or, if the management interface is exposed to the internet, from anywhere on the internet.

The attack flow typically involves:

1. Identifying a vulnerable JD Cloud router on the network
2. Crafting a malicious request containing command injection payload
3. Sending the request to the router's management interface
4. The router executes the injected commands with system-level privileges

Additional technical analysis is available in the Notion RCE Analysis document.

Detection Methods for CVE-2025-66848

Indicators of Compromise

• Unexpected outbound network connections from router devices to unknown IP addresses
• Modified router configurations without administrator action
• Unauthorized user accounts or SSH keys added to the router
• Unusual processes running on the router device
• Evidence of reverse shell connections originating from router IP addresses

Detection Strategies

• Monitor network traffic for anomalous HTTP requests to router management interfaces containing shell metacharacters or command injection patterns
• Implement intrusion detection rules to identify exploitation attempts targeting JD Cloud router web interfaces
• Review router logs for authentication failures followed by successful command execution
• Deploy network monitoring to detect unusual traffic patterns from router devices

Monitoring Recommendations

• Implement continuous monitoring of router management interface access logs
• Set up alerts for any configuration changes on affected router models
• Monitor for DNS queries or network connections to suspicious domains originating from router IP addresses
• Regularly audit router firmware versions across the network to identify unpatched devices

How to Mitigate CVE-2025-66848

Immediate Actions Required

• Identify all JD Cloud NAS routers in your environment and verify their firmware versions
• Restrict access to router management interfaces to trusted IP addresses only
• Disable remote management access from the internet if not strictly required
• Implement network segmentation to isolate vulnerable routers from critical assets
• Monitor affected devices for signs of compromise

Patch Information

Organizations should check the JD Cloud official website for firmware updates that address this vulnerability. Given the critical severity, applying patches should be prioritized as soon as vendor-provided updates become available. Verify firmware integrity after updating to ensure the patch was applied correctly.

Workarounds

• Disable WAN-side management interface access to prevent remote exploitation
• Configure firewall rules to restrict access to router management ports (typically HTTP/HTTPS on ports 80/443)
• Enable access control lists (ACLs) on the router to limit management access to specific administrator IPs
• Consider placing a firewall in front of affected routers to filter malicious traffic

# Example firewall rule to restrict management access (adjust for your environment)
# Allow management access only from trusted admin subnet
iptables -A INPUT -p tcp --dport 80 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP