{"id":"CVE-2025-69269","state":"PUBLISHED","title":"Spectrum command injection in NCM service","description":"Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Broadcom DX NetOps Spectrum on Windows, Linux allows OS Command Injection.This issue affects DX NetOps Spectrum: 23.3.6 and earlier.","publishedAt":"2026-01-12T04:10:44.802Z","updatedAt":"2026-01-12T15:51:36.355Z","severity":{"score":7.1,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:L/SI:H/SA:N","source":"ca"},"assigner":"ca","products":["Broadcom DX NetOps Spectrum"],"affected":[{"vendor":"Broadcom","product":"DX NetOps Spectrum","defaultStatus":"unaffected","versions":[{"version":"23.3.6 and earlier","status":"affected","versionType":"custom"},{"version":"23.3.7 and later","status":"unaffected","versionType":"custom"}],"platforms":["Windows","Linux"]}],"references":["https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36756"],"weaknesses":["CWE-78"],"ingestedAt":"2026-10-29T20:09:56.034Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/69xxx/CVE-2025-69269.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-69269","state":"PUBLISHED","datePublished":"2026-01-12T04:10:44.802Z","dateUpdated":"2026-01-12T15:51:36.355Z","assignerShortName":"ca","assignerOrgId":"e291eae9-7c0a-46ac-ba7d-5251811f8b7f","dateReserved":"2025-12-31T03:22:49.490Z"},"containers":{"cna":{"title":"Spectrum command injection in NCM service","descriptions":[{"lang":"en","value":"Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Broadcom DX NetOps Spectrum on Windows, Linux allows OS Command Injection.This issue affects DX NetOps Spectrum: 23.3.6 and earlier."}],"affected":[{"vendor":"Broadcom","product":"DX NetOps Spectrum","defaultStatus":"unaffected","versions":[{"version":"23.3.6 and earlier","status":"affected","versionType":"custom"},{"version":"23.3.7 and later","status":"unaffected","versionType":"custom"}],"platforms":["Windows","Linux"]}],"references":[{"url":"https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36756","tags":["vendor-advisory"]}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":7.1,"baseSeverity":"HIGH","exploitMaturity":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:L/SI:H/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-78","description":"CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"ca","orgId":"e291eae9-7c0a-46ac-ba7d-5251811f8b7f","dateUpdated":"2026-01-12T04:10:44.802Z"},"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:broadcom:dx_netops_spectrum:23.3.6_and_earlier:*:windows:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:broadcom:dx_netops_spectrum:23.3.6_and_earlier:*:linux:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:broadcom:dx_netops_spectrum:23.3.7_and_later:*:windows:*:*:*:*:*","vulnerable":false},{"criteria":"cpe:2.3:a:broadcom:dx_netops_spectrum:23.3.7_and_later:*:linux:*:*:*:*:*","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"OR"}],"credits":[{"lang":"en","type":"finder","value":"Jean-Michel Huguet and Jorge Escabias from NATO Cyber Security Centre"}],"datePublic":"2026-01-12T04:00:00.000Z","impacts":[{"capecId":"CAPEC-88","descriptions":[{"lang":"en","value":"CAPEC-88 OS Command Injection"}]}],"source":{"advisory":"CA20260112-01: Security Notice for DX NetOps Spectrum","discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.5.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-01-12T15:51:21.445557Z","id":"CVE-2025-69269","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-01-12T15:51:36.355Z"}}]}}}