CVE-2025-32002: Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in I-O DATA network attached hard disk...
9.8
CVSS
Description
Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in I-O DATA network attached hard disk 'HDL-T Series' firmware Ver.1.21 and earlier when 'Remote Link3 function' is enabled. If exploited, a remote unauthenticated attacker may execute an arbitrary OS command.
Classification
CVE ID: CVE-2025-32002
CVSS Base Severity: CRITICAL
CVSS Base Score: 9.8
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Problem Types
Improper neutralization of special elements used in an OS command ('OS Command Injection')Affected Products
Vendor: I-O DATA DEVICE, INC.
Product: HDL-TC1, HDL-TC500, HDL-T1NV, HDL-T1WH, HDL-T2NV, HDL-T2WH, HDL-T3NV, HDL-T3WH
Exploit Prediction Scoring System (EPSS)
EPSS Score: 0.62% (probability of being exploited)
EPSS Percentile: 68.99% (scored less or equal to compared to others)
EPSS Date: 2025-06-06 (when was this score calculated)
References
https://nvd.nist.gov/vuln/detail/CVE-2025-32002https://www.iodata.jp/support/information/2025/05_hdl-t/
https://jvn.jp/en/vu/JVNVU91726405/