CVE-2025-69269 is a critical OS command injection (CVSS 9.8) in Broadcom DX NetOps Spectrum on Windows and Linux, versions 23.3.6 and earlier. The record names no fixed version, so apply the remediation in Broadcom security advisory 36756 and limit network access to the product.
What's affected
- Broadcom DX NetOps Spectrum 23.3.6 and earlier, on Windows and Linux.
- Fixed version: not stated in the record. See Broadcom security advisory 36756.
How to check if you're exposed
Read the installed Spectrum version from your OneClick console or the installation records, and compare it with 23.3.6. Any version at or below it is in scope.
Spectrum collects data from network devices and often runs with wide reach across the network, so also check which networks can reach its web and service ports.
What to do now
- Find all DX NetOps Spectrum servers.
- Open advisory 36756 on the Broadcom support site and apply the listed update or patch.
- Limit access to Spectrum to management networks.
- Review the service account the product runs under and reduce its rights.
- Check for unusual child processes or new accounts on the Spectrum host.
Management tools see the whole network, so attackers value them. Put Spectrum on its own management segment, run its service accounts with narrow rights, and ship its logs to a place the host itself cannot change. These steps help with this CVE and with whichever one comes next.
Why it matters
The weakness is CWE-78, OS command injection. Input is passed into a command that the operating system runs, so special characters can add commands the developer never meant to allow.
The vector needs no login and no user action, and the impact is high on all counts. A network monitoring server holds credentials for many devices, so a takeover has reach. The same Broadcom advisory covers CVE-2025-69270. The record does not list this CVE as exploited in the wild.
Quick check
Where do I find the fix for CVE-2025-69269?
In Broadcom security advisory 36756, referenced in the record. The record itself names no fixed version.
Sources
Last reviewed: 19 October 2026.
