CVE-2025-25504
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
An issue in the /usr/local/bin/jncs.sh script of Gefen WebFWC (in AV over IP products) versions v1.85h, v1.86v, and v1.70 allows attackers with network access to connect to the device over TCP port 4444 without authentication and execute arbitrary commands with root privileges.
Risk Assessment
The risk for the organization is the potential for an unauthorized attacker to gain full control over the vulnerable device from the network. This could compromise the confidentiality, integrity, and availability of AV over IP systems and potentially the entire internal network.
Recommendation
Immediately block access to TCP port 4444 on the network firewall for unauthorized hosts and contact the vendor to obtain a firmware update that fixes the vulnerability.
Original NVD description (English source)
An issue in the /usr/local/bin/jncs.sh script of Gefen WebFWC (In AV over IP products) v1.85h, v1.86v, and v1.70 allows attackers with network access to connect to the device over TCP port 4444 without authentication and execute arbitrary commands with root privileges.