CVE-2025-66848

published 2025-12-30

CVE-2025-66848: JD Cloud NAS routers AX1800 (4.3.1.r4308 and earlier), AX3000 (4.3.1.r4318 and earlier), AX6600 (4.5.1.r4533 and earlier), BE6500 (4.4.1.r4308 and earlier)…

Priority P2 62 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

JD Cloud NAS routers AX1800 (4.3.1.r4308 and earlier), AX3000 (4.3.1.r4318 and earlier), AX6600 (4.5.1.r4533 and earlier), BE6500 (4.4.1.r4308 and earlier), ER1 (4.5.1.r4518 and earlier), and ER2 (4.5.1.r4518 and earlier) contain an unauthorized remote command execution vulnerability.

Affected

6 ranges

Vendor	Product	Version range	Fixed in
jdcloud	ax1800_firmware	<= 4.3.1.r4308	—
jdcloud	ax3000_firmware	<= 4.3.1.r4318	—
jdcloud	ax6600_firmware	<= 4.5.1.r4533	—
jdcloud	be6500_firmware	<= 4.4.1.r4308	—
jdcloud	er1_firmware	<= 4.5.1.r4518	—
jdcloud	er2_firmware	<= 4.5.1.r4518	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-94