OS command injection in iND Co.,Ltd HL330-DLS
Priority MEDIUM 42CWE-78Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-78.
Summary
Multiple products provided by iND Co.,Ltd contain an OS command injection vulnerability. If exploited, an arbitrary OS command may be executed and sensitive information may be obtained. As for the details of affected product names and versions, refer to the information under [Product Status].
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0126 69th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| iND Co.,Ltd | HL330-DLS (for module MC7700) | firmware version 1.03 and earlier | — | No fix listed | CNA |
| iND Co.,Ltd | HL330-DLS (for module MC7330) | firmware version 2.02t and earlier | — | No fix listed | CNA |
| iND Co.,Ltd | HL320-DLS (for module MC7700) | firmware version 1.03 and earlier | — | No fix listed | CNA |
| iND Co.,Ltd | HL320-DLS (for module MC7330) | firmware version 2.02t and earlier | — | No fix listed | CNA |
| iND Co.,Ltd | LM-100 | firmware version 1.02 and earlier | — | No fix listed | CNA |
| iND Co.,Ltd | LM-200 (for module AMP570) | firmware version 1.02 and earlier | — | No fix listed | CNA |
| iND Co.,Ltd | LM-200 (for module EC25-J) | firmware version 1.05e and earlier | — | No fix listed | CNA |
| iND Co.,Ltd | L2X Assist | firmware version 2.01 and earlier | — | No fix listed | CNA |
| iND Co.,Ltd | L2X Assist-RS-A | firmware version 1.11 and earlier | — | No fix listed | CNA |
| iND Co.,Ltd | L2X Assist-RS-E | firmware version 1.12 and earlier | — | No fix listed | CNA |
| iND Co.,Ltd | F2L Assist-SS-A | firmware version 1.03 and earlier | — | No fix listed | CNA |
| iND Co.,Ltd | F2L Assist-SS-E | firmware version 1.01 and earlier | — | No fix listed | CNA |
- HL330-DLS (for module MC7700) VendoriND Co.,Ltd Affected firmware version 1.03 and earlier Fixed in — No fix listed CNA
- HL330-DLS (for module MC7330) VendoriND Co.,Ltd Affected firmware version 2.02t and earlier Fixed in — No fix listed CNA
- HL320-DLS (for module MC7700) VendoriND Co.,Ltd Affected firmware version 1.03 and earlier Fixed in — No fix listed CNA
- HL320-DLS (for module MC7330) VendoriND Co.,Ltd Affected firmware version 2.02t and earlier Fixed in — No fix listed CNA
- LM-100 VendoriND Co.,Ltd Affected firmware version 1.02 and earlier Fixed in — No fix listed CNA
- LM-200 (for module AMP570) VendoriND Co.,Ltd Affected firmware version 1.02 and earlier Fixed in — No fix listed CNA
- LM-200 (for module EC25-J) VendoriND Co.,Ltd Affected firmware version 1.05e and earlier Fixed in — No fix listed CNA
- L2X Assist VendoriND Co.,Ltd Affected firmware version 2.01 and earlier Fixed in — No fix listed CNA
- L2X Assist-RS-A VendoriND Co.,Ltd Affected firmware version 1.11 and earlier Fixed in — No fix listed CNA
- L2X Assist-RS-E VendoriND Co.,Ltd Affected firmware version 1.12 and earlier Fixed in — No fix listed CNA
- F2L Assist-SS-A VendoriND Co.,Ltd Affected firmware version 1.03 and earlier Fixed in — No fix listed CNA
- F2L Assist-SS-E VendoriND Co.,Ltd Affected firmware version 1.01 and earlier Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2025-53508
- 2026-10-03 Alias added: GHSA-gf66-qjh7-prj2
References
More iND Co.,Ltd vulnerabilities
- TI-2025-33452 Insecure storage of sensitive information in iND Co.,Ltd HL330-DLS CVSS 4.0HIGH 7.1
Sources
- CVE-2025-53508 · CVE Program
- CVE-2025-53508 · NVD
- FIRST EPSS
- GHSA-gf66-qjh7-prj2 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences