Skip to content
OpenAdvisories
Critical · 9.8 CVE-2025-32002 EUVD-2025-15148GHSA-8x6j-j8rc-9m7p

Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in I-O DATA network attached hard d…

Published May 15, 2025 · Updated May 15, 2025 · Assigned by jpcert

Vendor: I-O DATA DEVICE Product: HDL-T1NV Product: HDL-T1WH Product: HDL-T2NV Product: HDL-T2WH Product: HDL-T3NV Product: HDL-T3WH Product: HDL-TC1 Product: HDL-TC500

Description

Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in I-O DATA network attached hard disk 'HDL-T Series' firmware Ver.1.21 and earlier when 'Remote Link3 function' is enabled. If exploited, a remote unauthenticated attacker may execute an arbitrary OS command.

Affected products

VendorProductAffectedFixed
I-O DATA DEVICE HDL-TC1 Ver.1.21 and earlier —
I-O DATA DEVICE HDL-TC500 Ver.1.21 and earlier —
I-O DATA DEVICE HDL-T1NV Ver.1.21 and earlier —
I-O DATA DEVICE HDL-T1WH Ver.1.21 and earlier —
I-O DATA DEVICE HDL-T2NV Ver.1.21 and earlier —
I-O DATA DEVICE HDL-T2WH Ver.1.21 and earlier —
I-O DATA DEVICE HDL-T3NV Ver.1.21 and earlier —
I-O DATA DEVICE HDL-T3WH Ver.1.21 and earlier —

References