Unrated severityNVD Advisory· Published Mar 19, 2026· Updated Mar 24, 2026

CVE-2025-67113

Description

OS command injection in the CWMP client (/ftl/bin/cwmp) of Small Cell Sercomm SCE4255W (FreedomFi Englewood) firmware before DG3934v3@2308041842 allows remote attackers controlling the ACS endpoint to execute arbitrary commands as root via a crafted TR-069 Download URL that is passed unescaped into the firmware upgrade pipeline.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Sercomm/Small Cell Sercomm SCE4255Wdescription
Sercomm/SCE4255Wllm-fuzzy
Range: < DG3934v3@2308041842

Patches

Vulnerability mechanics

References

fcc.report/FCC-ID/P27-SCE4255W/4790935.pdfmitre
freedomfi.com/index.htmlmitre
neroteam.com/blog/freedomfi-sercomm-sce4255w-englewoodmitre

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000