CVE-2025-6522 MEDIUM

CVE-2025-6522: TrendMakers Sight Bulb Pro Command Injection

Vendor Trendmakers
Product Sight Bulb Pro Firmware ZJ_CG32-2201
Weakness CWE-77
Published June 27, 2025
Last update June 27, 2025
View on NVD All CVEs

CVSS base score

5.4/10
Attack vector Adjacent
Attack complexity Low
Privileges required High
User interaction Required
Confidentiality Low
Integrity High

CVSS vector

CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:U/C:L/I:H/A:L

What the vulnerability does

01Description

Unauthenticated users on an adjacent network with the Sight Bulb Pro can run shell commands as root through a vulnerable proprietary TCP protocol available on Port 16668. This vulnerability allows an attacker to run arbitrary commands on the Sight Bulb Pro by passing a well formed JSON string.

Key dates

02Disclosure timeline

June 27, 2025 CVE published
June 27, 2025 Record updated