Remote Command Execution Vulnerability in Sight Bulb Pro by Visionary Tech
CVE-2025-6522

5.2MEDIUM

Key Information:

Vendor

Trendmakers

Status
Sight Bulb Pro Firmware Zj Cg32-2201
Vendor
CVE Published:
27 June 2025

What is CVE-2025-6522?

An exploit in the Sight Bulb Pro by Visionary Tech permits unauthenticated users on an adjacent network to execute shell commands as root. This is achieved through a vulnerable proprietary TCP protocol operational on Port 16668, allowing attackers to send a specially crafted JSON string that triggers arbitrary command execution. This vulnerability poses significant risks to the integrity and security of the device, potentially compromising user data.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Sight Bulb Pro Firmware ZJ_CG32-2201 0 <= 8.57.83

References

https://www.cisa.gov/news-events/ics-advisories/icsa-25-1...
https://www.trendmakerscares.com/Customer-Service-Hours

CVSS V4

Score:
5.2
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
High
Availability:
Low
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Fahim Balouch reported these vulnerabilities to CISA.
JSON
.