CVE-2025-66848 is a critical unauthorized remote command execution vulnerability affecting multiple JD Cloud NAS router models. The affected firmware versions are 4.3.1.r4308 and earlier for AX1800, 4.3.1.r4318 and earlier for AX3000, 4.5.1.r4533 and earlier for AX6600, 4.4.1.r4308 and earlier for BE6500, and 4.5.1.r4518 and earlier for ER1 and ER2. This vulnerability corresponds to CWE-94 (Improper Control of Generation of Code). An attacker can remotely execute arbitrary commands without authentication, potentially leading to full system compromise. No known exploits in the wild have been reported as of the published date. No patch or vendor advisory information is provided, so patch status is not confirmed.

Successful exploitation allows an unauthenticated remote attacker to execute arbitrary commands on affected JD Cloud NAS routers, leading to complete compromise of confidentiality, integrity, and availability. This could result in unauthorized control over the device and disruption of network services.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the affected devices, especially from untrusted networks, to reduce exposure. Monitor for vendor updates regarding patches or mitigations.