CVE-2025-9387 is a medium severity (6.3) OS command injection flaw in DCN DCME-720 Gateway, affecting firmware 9.1.5.11. No fixed version is confirmed. Until a fix is confirmed, restrict who can reach the device, review the affected code path, and scan your dependencies.
What's affected
- Product: DCN DCME-720 Gateway
- Affected versions: firmware 9.1.5.11
- Component:
/usr/local/www/function/audit/newstatistics/ip_block.php (Web Management Backend) - Parameter: the
ipparameter - Severity: Medium, CVSS 6.3 (
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) - Weakness classes: CWE-77, CWE-78
- Fixed version: No fixed version is confirmed, so the vendor advisory or release page should be checked
The NVD description says the ip parameter is passed into an operating system command without enough control. It also says the attack can be started remotely and that an exploit has been made public. The record does not list a fixed version, and the reference pages we could reach did not either.
This is device firmware. Fixes, if any, arrive as a vendor firmware image rather than a package update.
The public report we read describes the same product, file and parameter as the record, so we found no conflict in affected versions or severity between the two. Severity above is the score in the record. The advisory text itself gives no separate score.
How to check if you're exposed
Log in to the device's own management page and read the firmware version. Compare it with the affected range (firmware 9.1.5.11). The record names that build, and the advisory does not say which other builds are or are not affected.
Next, find out whether the management interface is reachable from outside your network. From a machine outside the network, check whether the management port answers at all. If it does, that is the first thing to change.
Check the vendor's support page for a newer firmware image and its release notes. There is no package manager command that covers this, so the vendor page is the source of truth.
What to do now
- Find it. Work out whether DCN DCME-720 Gateway is installed anywhere in your estate, including test servers and old demos.
- Limit exposure. Put the application behind a VPN or an IP allowlist, or take it offline if nobody needs it.
- Look for a fix. Check the vendor's site or repository for a newer release. If none exists, ask the vendor directly and record the answer.
- Close the gap if you can. Restrict who can reach the management interface. If you control the code, stop passing user input to a shell and validate it against a strict format.
- Watch the logs. Keep web server logs for the affected path and review them for odd input.
- Scan. Run your dependency manifest through the free in-browser dependency scan to see what else is exposed.
Why it matters
OS command injection (CWE-78) happens when a program builds a shell command from request values and runs it. If the value is not controlled, the shell can be made to do more than the developer intended. On a network appliance that often means control of the device, which usually sits at a trust boundary.
The record scores this medium at 6.3, with low privileges required, which means the caller needs a login first. That lowers the odds, but weak or shared management passwords are common on devices like this.
The record shows the CISA Known Exploited Vulnerabilities flag as false, and nothing we read reports use in real attacks. The NVD description does say a proof of concept is public, which lowers the effort for anyone who wants to try it. Treat it as exposed if the product is reachable.
Notes for developers
If you maintain code like this, avoid shell calls that include request values. Use a library function for the task, or pass arguments as a list so no shell parses them. Where a value must be used, check it against a strict format such as an IP address pattern before it goes anywhere near a command.
Where reachability helps
A scan list tells you which products are present. Reachability analysis tells you whether your own code can actually call the vulnerable path. For source distributed projects, that is the difference between a long list of findings and the few that sit on a route someone can reach. The Safeguard Gold directory tracks this record, so you can follow changes to its score or references.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is a patch available?
The record and the report we read name no fixed release, so check the vendor's site for a newer version before assuming you are covered. Check the vendor page again before you act, because this can change.
Does this CVE mean attackers are using it now?
Not according to the sources we read. The CISA KEV flag in the record is false. The NVD description does say an exploit is public, so exposure is still worth treating seriously.
Sources
- NVD record and Safeguard Gold entry for CVE-2025-9387
- Public vulnerability report for this CVE
- Other references in the record, including VulDB, could not be retrieved when we checked.
Last reviewed: 18 October 2026.
