CVE-2025-32002 Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in I-O DATA network attached hard disk 'HDL-T Series' firmware Ver.1.21 and earlier when 'Remote...
CriticalCVSS 9.3
EPSS 1.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in I-O DATA network attached hard disk 'HDL-T Series' firmware Ver.1.21 and earlier when 'Remote Link3 function' is enabled. If exploited, a remote unauthenticated attacker may execute an arbitrary OS command.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| i-o data device HDL-TC1 | = Ver.1.21 and earlier | No fix listed |
| i-o data device HDL-TC500 | = Ver.1.21 and earlier | No fix listed |
| i-o data device HDL-T1NV | = Ver.1.21 and earlier | No fix listed |
| i-o data device HDL-T1WH | = Ver.1.21 and earlier | No fix listed |
| i-o data device HDL-T2NV | = Ver.1.21 and earlier | No fix listed |
| i-o data device HDL-T2WH | = Ver.1.21 and earlier | No fix listed |
| i-o data device HDL-T3NV | = Ver.1.21 and earlier | No fix listed |
| i-o data device HDL-T3WH | = Ver.1.21 and earlier | No fix listed |