Multiple vulnerabilities in New Rock Technologies Cloud Connected Devices



Risk High
Patch available NO
Number of vulnerabilities 2
CVE-ID CVE-2025-0680
CVE-2025-0681
CWE-ID CWE-78
CWE-155
Exploitation vector Network
Public exploit N/A
Vulnerable software
 OM500 IP-PBX
Hardware solutions / Firmware

MX8G VoIP Gateway
Hardware solutions / Firmware

NRP1302/P Desktop IP Phone
Hardware solutions / Firmware

Vendor New Rock Technologies

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) OS Command Injection

EUVDB-ID: #VU103473

Risk: High

CVSSv4.0: 8.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2025-0680

CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.

The vulnerability exists due to improper input validation in the device cloud rpc command handling process. A remote unauthenticated attacker can pass specially crafted data to the application and execute arbitrary OS commands on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

Vulnerable software versions

OM500 IP-PBX: All versions

MX8G VoIP Gateway: All versions

NRP1302/P Desktop IP Phone: All versions

CPE2.3 External links

https://www.cisa.gov/news-events/ics-advisories/icsa-25-030-02
https://www.newrocktech.com/ContactUs/index.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Improper neutralization of wildcards or matching symbols

EUVDB-ID: #VU103474

Risk: Low

CVSSv4.0: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-0681

CWE-ID: CWE-155 - Improper Neutralization of Wildcards or Matching Symbols

Exploit availability: No

Description

The vulnerability allows a local attacker to gain access to potentially sensitive information.

The vulnerability exists due to Cloud MQTT service supports wildcard topic subscription. A local attacker can obtain sensitive information from tapping the service communications.

Mitigation

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

Vulnerable software versions

OM500 IP-PBX: All versions

MX8G VoIP Gateway: All versions

NRP1302/P Desktop IP Phone: All versions

CPE2.3 External links

https://www.cisa.gov/news-events/ics-advisories/icsa-25-030-02
https://www.newrocktech.com/ContactUs/index.html


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###