OS command injection in BEC Technologies Multiple Routers
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · CNA. Fix status from CNA. Impact type from CWE-78.
Summary
BEC Technologies Multiple Routers sys ping Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of BEC Technologies Multiple Routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the management interface, which listens on TCP port 22 by default. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-25903.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| BEC Technologies | Multiple Routers | 1.04.1.512, 1.04.1.542 | — | No fix listed | CNA |
- Multiple Routers VendorBEC Technologies Affected 1.04.1.512, 1.04.1.542 Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:bectechnologies:router_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | BEC Technologies |
- cpe:2.3:o:bectechnologies:router_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·BEC Technologies
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2025-2773
- 2026-10-03 Alias added: GHSA-jghh-8mmw-259x
References
Advisory 1
More BEC Technologies Router Firmware vulnerabilities
- TI-2025-02423 Improper authentication in BEC Technologies Multiple Routers CVSS 3.0MEDIUM 5.3
- TI-2025-02424 Insufficiently protected credentials in BEC Technologies Multiple Routers CVSS 3.1MEDIUM 6.5
- TI-2025-02422 Cleartext storage of sensitive information in BEC Technologies Multiple Routers CVSS 3.1MEDIUM 6.5
Sources
- CVE-2025-2773 · CVE Program
- CVE-2025-2773 · NVD
- FIRST EPSS
- GHSA-jghh-8mmw-259x · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences