CVE-2025-64444 is an OS command injection vulnerability in NCP-HG100 firmware version 1.4.48.16 and earlier. A remote attacker with valid authentication credentials to the management interface can execute arbitrary OS commands with root privileges. This vulnerability arises from improper neutralization of special elements in OS commands.