CVE-2025-3002

Digital China's DCME-520 contains an OS command injection flaw (CWE-77/CWE-78) in the script /usr/local/WWW/function/audit/newstatistics/mon_merge_stat_hist.php, where the type_name parameter is passed to the operating system without adequate validation. The attack can be launched remotely over the network and requires no privileges or user interaction per the CVSS scoring, and other parameters in the affected script may also be vulnerable. An attacker who successfully exploits the flaw can inject and execute arbitrary operating system commands on the controller, potentially giving them control of the device and a foothold in the network it manages. Affected are DCME-520 deployments with firmware up to the 20250320 build; other DCME products are not confirmed in the available data. The exploit has been publicly disclosed and, with an EPSS of 20% (97th percentile), there is an elevated probability of exploitation in the next 30 days, though the flaw is not yet on the CISA KEV list and no public PoC code is catalogued.

What to do: Because no fixed version is published in the available data, contact Digital China or your reseller for a patched firmware for the DCME-520. In the meantime, restrict web-based management access to the controller (including the /usr/local/WWW/function/audit/newstatistics/ endpoint) to trusted management networks and disable internet-exposed management if possible. Check device logs for unexpected process executions or requests containing crafted type_name values to detect exploitation attempts.