New Rock Technologies Cloud Connected Devices

Summary

Vulnerabilities 2

• Critical 9.8
  CVE-2025-0680

  New Rock Technologies Cloud Connected Devices has a Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability.

  Affected products contain a vulnerability in the device cloud rpc command handling process that could allow remote attackers to take control over arbitrary devices connected to the cloud.

  New Rock Technologies NRP1302/P Desktop IP Phone MX8G VoIP Gateway OM500 IP-PBX
  Jan 30, 2025
• Medium 6.2
  CVE-2025-0681

  New Rock Technologies Cloud Connected Devices Improper Neutralization of Wildcards or Matching Symbols

  The Cloud MQTT service of the affected products supports wildcard topic subscription which could allow an attacker to obtain sensitive information from tapping the service communications.

  New Rock Technologies MX8G VoIP Gateway OM500 IP-PBX NRP1302/P Desktop IP Phone
  Jan 30, 2025

Revision history

1. 2025-01-30 #1

   Initial Publication

References

• ICSA Advisory ICSA-25-030-02 - Web Version
  https://www.cisa.gov/news-events/ics-advisories/icsa-25-030-02
• Recommended Practices
  https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
• Recommended Practices
  https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
• Recommended Practices
  https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
• Recommended Practices
  https://www.cisa.gov/topics/industrial-control-systems
• Recommended Practices
  https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
• Recommended Practices
  https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B
• Recommended Practices
  https://www.cisa.gov/uscert/sites/default/files/publications/emailscams0905.pdf
• Recommended Practices
  https://www.cisa.gov/uscert/ncas/tips/ST04-014