OS Command Injection in iND products - CVE-2025-53508

Vulnerability identifier: #VU115206

CSH Severity: Low

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-53508

CWE-ID: CWE-78

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to execute arbitrary shell commands on the target system.

The vulnerability exists due to improper input validation. A remote administrator can pass specially crafted data to the application and execute arbitrary OS commands on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

HL330-DLS (for module MC7700)
HL330-DLS (for module MC7330)
F2L Assist-SS-E
LM-100
F2L Assist-SS-A
LM-200 (for module AMP570)
L2X Assist-RS-E
LM-200 (for module EC25-J)
L2X Assist-RS-A
L2X Assist

Install updates from vendor's website.

F2L Assist-SS-E - update to 1.02
LM-100 - update to 1.03
F2L Assist-SS-A - update to 1.04
LM-200 (for module AMP570) - update to 1.03
L2X Assist-RS-E - update to 1.13
LM-200 (for module EC25-J) - update to 1.06e
L2X Assist-RS-A - update to 1.12
L2X Assist - update to 2.02

• https://jvn.jp/en/jp/JVN50585992/
• https://www.i-netd.co.jp/vulnerability/dceid-2025-001/

• Multiple vulnerabilities in iND products