CVE-2025-34117

Multiple Netcore and Netis router models ship with an undocumented, hardcoded backdoor listening on UDP port 53413, present in all firmware released prior to August 2014. An unauthenticated remote attacker can send specially crafted UDP packets to this listener, pass the hardcoded authentication mechanism, and execute arbitrary shell commands on the device. Successful exploitation gives the attacker full control of the router (device confidentiality, integrity, and availability are all rated high), which can be used for traffic interception, botnet enlistment, or pivoting to internal networks. All Netcore and Netis routers running pre-August 2014 firmware are affected, though exact version boundaries are undocumented and a non-standard `echo` implementation on some models may affect exploitability. No public proof-of-concept or CISA KEV listing is known at this time, but the 27.9% EPSS score (98th percentile) indicates an elevated probability of exploitation within 30 days.

What to do: Audit internet-facing router IPs for UDP port 53413 and block or restrict that port at the network perimeter as an immediate mitigation, since exploitation requires reaching the listener. Upgrade affected devices to firmware released after August 2014, or current vendor firmware where available; because exact version boundaries are undocumented, verification by probing UDP/53413 is the most reliable check. For Netcore/Netis routers that are end-of-life and cannot receive patched firmware, replacement should be considered, as hardcoded-backdoor flaws cannot be fully mitigated by filtering alone.