CVE-2025-66848

critical · 9.8

JD Cloud NAS routers AX1800 (4.3.1.r4308 and earlier), AX3000 (4.3.1.r4318 and earlier), AX6600 (4.5.1.r4533 and earlier), BE6500 (4.4.1.r4308 and earlier), ER1 (4.5.1.r4518 and earlier), and ER2 (4.5.1.r4518 and earlier) contain an unauthorized remote command execution vulnerability.

9.8

CVSS

1.0%

EPSS (exploit prob.)

62nd

EPSS percentile

2025-12-30

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-94

Affected products

Vendor	Product	Affected versions
jdcloud	ax1800_firmware	<= 4.3.1.r4308
jdcloud	ax1800	all versions
jdcloud	ax3000_firmware	<= 4.3.1.r4318
jdcloud	ax3000	all versions
jdcloud	ax6600_firmware	<= 4.5.1.r4533
jdcloud	ax6600	all versions
jdcloud	be6500_firmware	<= 4.4.1.r4308
jdcloud	be6500	all versions
jdcloud	er1_firmware	<= 4.5.1.r4518
jdcloud	er1	all versions
jdcloud	er2_firmware	<= 4.5.1.r4518
jdcloud	er2	all versions

Check a specific version with /api/v1/cve/match.

References

https://www.notion.so/JD-Cloud-Unauth-RCE-2d22b76e8e0c802c975bf186b208d0c2
https://www.jdcloud.com/cn/

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2025-66848