iND Co.,Ltd Firmware CVE-2025-53507/53508: Sensitive Info Disclosure & Command Injection

Critical Vulnerability Information Vulnerability ID JVN#50585992 Affected Products HL330-DLS (for module MC7700) firmware version 1.03 and earlier HL330-DLS (for module MC7330) firmware version 2.02t and earlier HL320-DLS (for module MC7700) firmware version 1.03 and earlier HL320-DLS (for module MC7330) firmware version 2.02t and earlier LM-100 firmware version 1.02 and earlier LM-200 (for module AMPS70) firmware version 1.02 and earlier LM-200 (for module EC25-J) firmware version 1.05e and earlier L2X Assist firmware version 2.01 and earlier L2X Assist-RS-A firmware version 1.11 and earlier L2X Assist-RS-E firmware version 1.12 and earlier F2L Assist-SS-A firmware version 1.03 and earlier F2L Assist-SS-E firmware version 1.01 and earlier Vulnerability Description Insecure Storage of Sensitive Information (CWE-922) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N Base Score 7.1 - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N Base Score 6.5 - CVE-2025-53507 Operating System Command Injection (CWE-78) - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VLH/VA:H/SC:N/SI:N/SA:N Base Score 8.6 - CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Base Score 7.2 - CVE-2025-53508 Impact Configuration information (such as administrator passwords) may be disclosed (CVE-2025-53507) Arbitrary operating system commands may be executed, leading to access to sensitive information (CVE-2025-53508) Solution Update firmware to the latest version, as per the information provided by the developer. Vendor Status iND Co.,Ltd: Vulnerable (Last updated: 2025/08/29) References JPCERT/CC Addendum Vulnerability analysis provided by JPCERT/CC Additional Information CVE: CVE-2025-53507, CVE-2025-53508 JVN iPedia: JVNDB-2025-000067

Goal Reached Thanks to every supporter — we hit 100%!

iND Co.,Ltd Firmware CVE-2025-53507/53508: Sensitive Info Disclosure & Command Injection