CVE-2025-0680 — New Rock Technologies Cloud Connected Devices has a Improper Neutralization of Special Elements used in an OS Command…

CVE-2025-0680

New Rock Technologies Cloud Connected Devices has a Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. PUBLISHED

Description (CNA)

Affected products contain a vulnerability in the device cloud rpc command handling process that could allow remote attackers to take control over arbitrary devices connected to the cloud.

Affected (CNA)

Vendor / product	Versions
New Rock Technologies / OM500 IP-PBX	affected All
New Rock Technologies / MX8G VoIP Gateway	affected All
New Rock Technologies / NRP1302/P Desktop IP Phone	affected All

CWE

CWE-78

References

https://www.cisa.gov/news-events/ics-advisories/icsa-25-030-02
https://www.newrocktech.com/ContactUs/index.html

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.