NVD disclosure day

Published threat advisories for December 4, 2025

CVE-2025-29269

ALLNET ALL-RUT22GW Command Injection Vulnerability

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

An OS command injection vulnerability exists in a specific industrial cellular router firmware, potentially allowing unauthenticated attackers to execute arbitrary commands remotely and compromise device operations. This could enable unauthorized control of network edge devices if reachable.

NVD published: December 4, 2025

CVE advisoryCRITICAL

CVE-2025-29268

ALLNET ALL-RUT22GW Stored Hardcoded Credentials Vulnerability

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

This vulnerability in specific industrial LTE cellular routers involves hardcoded credentials stored in a library, potentially allowing unauthorized network access and device compromise if the router is internet-exposed.

NVD published: December 4, 2025