Read the docs
TI-2025-42725 Aliases CVE-2025-69276GHSA-6r88-6433-9q7w

Spectrum insecure deserialiation

Priority LOW 12CWE-502Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
High
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-502.

Summary

Deserialization of Untrusted Data vulnerability in Broadcom DX NetOps Spectrum on Windows, Linux allows Object Injection.This issue affects DX NetOps Spectrum: 24.3.13 and earlier.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00306 23rd percentileScored 2026-11-07
Fix Fixed DX NetOps Spectrum (Broadcom): 25.4.1 and later

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
BroadcomDX NetOps Spectrumup to 24.3.1325.4.1 and laterPatch availableCNA
  • DX NetOps Spectrum VendorBroadcom Affected up to 24.3.13 Fixed in 25.4.1 and later Patch available CNA

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:broadcom:dx_netops_spectrum:*:*:*:*:*:*:*:*before 25.4.1VulnerableBroadcom
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*not specified by NVDRunning onLinux
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*not specified by NVDRunning onMicrosoft
  • cpe:2.3:a:broadcom:dx_netops_spectrum:*:*:*:*:*:*:*:* Versions before 25.4.1 Vulnerable ·Broadcom
  • cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Linux
  • cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft

Remediation

  • Fix · CNA DX NetOps Spectrum (Broadcom) Fixed in 25.4.1 and later

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Broadcom DX NetOps Spectrum — support.broadcom.com/web/ecx/support-content-notification/-…

    10 records Highest priority Priority MEDIUM 2 MEDIUM, 8 LOW

    Other records, highest priority first

    • TI-2025-42722 Spectrum broken authenticationPriority MEDIUM 40
    • TI-2025-42716 Spectrum directory path traversalPriority MEDIUM 40
    • TI-2025-42718 Spectrum command injection in NCM servicePriority LOW 33
    Show all 10 records → Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-69276
  2. 2026-10-03 Alias added: GHSA-6r88-6433-9q7w

References

Advisory 1

  • TI-2025-42722 Spectrum broken authentication CVSS 4.0HIGH 8.7
  • TI-2025-42716 Spectrum directory path traversal CVSS 4.0HIGH 8.8
  • TI-2025-42718 Spectrum command injection in NCM service CVSS 4.0HIGH 7.1
  • TI-2025-42724 Spectrum outdated java library in class-path CVSS 4.0HIGH 7.1
  • TI-2025-42721 Spectrum password returned in clear CVSS 4.0MEDIUM 5.3
  • TI-2025-42717 Spectrum reflected XSS CVSS 4.0MEDIUM 5.3
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences