Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.5

Gefen WebFWC allows unauthenticated network access to arbitrary commands

CVE-2025-25504 · published 1 year ago
Summary

An unpatched security flaw in Gefen WebFWC devices lets attackers connect to the device without a password and run any command on the system. This could allow malicious access to sensitive data or disrupt the device's operation. Update to a fixed version of the software to prevent unauthorized access.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
niceforyou gefen_webfwc 1.70v
1.85h
1.86v
cpe:2.3:a:niceforyou:gefen_webfwc:1.70v:*:*:*:*:*:*:*
Original advisory text
An issue in the /usr/local/bin/jncs.sh script of Gefen WebFWC (In AV over IP products) v1.85h, v1.86v, and v1.70 allows attackers with network access to connect to the device over TCP port 4444 wit...
An issue in the /usr/local/bin/jncs.sh script of Gefen WebFWC (In AV over IP products) v1.85h, v1.86v, and v1.70 allows attackers with network access to connect to the device over TCP port 4444 without authentication and execute arbitrary commands with root privileges.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
6.5 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-77Command Injection
CWE-287Improper Authentication
Timeline
Published5 May 2025
Updated4 Nov 2026
First seen7 Mar 2026
Sources
CVE-2025-25504 · NVD
CVE-2025-25504 · MITRE
Track software like this
Free during beta