CVE-2025-66848: Critical Flaw in JD Cloud Routers Grants Hackers Root Access

CVE-2025-66848 is a critical flaw in JD Cloud NAS routers that could allow remote attackers to bypass authentication and gain root access. The vulnerability, tracked under CVE-2025-66848 with a CVSS of 9.8, begins with an unsecured API interface (/api/joylink) that leaks the router’s MAC address and a unique feedid. Armed with this data, an attacker can generate a valid administrative token via a hashing step and use the API to reset the device password, paving the way for further exploitation.

The report describes a secondary command-injection vulnerability in the DDNS service that lets a malicious payload in the ddns_name field trigger a backdoor connection to the attacker’s server. This chain can ultimately give attackers root privileges on the remote device, enabling monitoring of traffic, malware installation, or movement to other devices on the local network. Affected models include AX1800, AX1800 Pro, AX3000, AX6600, BE6500, and ER1/ER2 across specified firmware versions. Users are urged to check for firmware updates immediately to close the door on intruders.