CVE Intelligence
Analysis AI-assisted

CVE-2025-63624: Shandong Kede IoT Water Meter Platform SQL Injection

CVE-2025-63624 is an SQL injection flaw in the IoT smart water meter monitoring platform from Shandong Kede Electronics Co., Ltd, version 1.0, reachable through the imei_list.aspx file. The record describes it as allowing a remote attacker to execute arbitrary code and assigns a CVSS 3.1 base score of 9.8. No fixed version or CISA KEV listing appears in the record, so organizations should prioritize access restriction and vendor follow-up.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2025-63624 describes an SQL injection vulnerability (CWE-89) in the IoT smart water meter monitoring platform from Shandong Kede Electronics Co., Ltd, version 1.0. According to the record, the flaw is reachable through the imei_list.aspx file and allows a remote attacker to execute arbitrary code. The CVE was published on 2026-02-03 and its status is Analyzed in the sources consulted.

Impact

  • The record states that a remote attacker may execute arbitrary code, which would be a high-severity outcome.
  • The record assigns CVSS 3.1 base score 9.8 with the vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating network access, no privileges and no user interaction required, with high impact to confidentiality, integrity and availability.
  • Inference: because the platform monitors metering devices, compromise could affect the integrity of meter readings, the availability of monitoring services and the confidentiality of customer or operational data. The record does not describe these consequences directly.

Affected products and versions

  • Product listed in the record: Sdkede Iot Smart Water Meter Firmware, version 1.0.
  • The description names the vendor as Shandong Kede Electronics Co., Ltd and the affected component as its IoT smart water meter monitoring platform.
  • Other versions, builds or deployment configurations are not listed in the record and their status is unknown.

Exploitation status

  • CISA KEV does not list this CVE in the record, so no confirmed active exploitation can be stated from that source.
  • No confirmed exploitation appears in the sources consulted.
  • The record references a third-party GitHub repository tagged as Exploit and Third Party Advisory. The presence of a public reference tagged this way means defenders should assume the flaw is publicly discussed, but this analysis does not describe or reproduce any technique.
  • The EPSS score is not available in the record, so the probability of exploitation is unknown.

Remediation and mitigation

  • No fixed version is listed in the record. The absence of a fixed version does not confirm that no fix exists; contact Shandong Kede Electronics or the product distributor to request an update or a security advisory.
  • Until a vendor fix is confirmed, restrict network access to the monitoring platform, placing it behind VPN or allow-listed management networks and removing direct internet exposure.
  • Isolate metering management systems from general corporate networks and limit administrative access to named accounts.
  • Require the vendor or integrator to confirm that database queries use parameterized statements and that input validation is applied to all request parameters.
  • Consider web application firewall rules as a temporary compensating control, recognizing that they do not replace a code fix.
  • Review the NVD record and the CVE record for updates.

Detection guidance

  • Review web server and application logs for unexpected or malformed requests to the imei_list.aspx endpoint, especially requests from unfamiliar sources or with abnormal parameter lengths and character sets.
  • Monitor the platform for database errors, unexpected process creation on the application server and outbound connections not associated with normal operation.
  • Correlate alerts with asset inventories to confirm which systems run version 1.0 of the platform.

Limitations of the available information

  • The record lacks a fixed version, vendor advisory, EPSS score and SSVC data.
  • The record does not specify deployment conditions, authentication requirements for the endpoint or the exact scope of affected installations.
  • The product name in the affected list differs from the vendor name in the description, so asset matching should use both names and the version.
  • Exploitation status is limited to the sources consulted.

Frequently asked questions

What is CVE-2025-63624?

It is an SQL injection vulnerability in the IoT smart water meter monitoring platform from Shandong Kede Electronics Co., Ltd, version 1.0, reachable through the imei_list.aspx file. The record says it allows a remote attacker to execute arbitrary code.

Is this CVE known to be actively exploited?

CISA KEV does not list it in the record, and no confirmed exploitation appears in the sources consulted. The record does reference a third-party repository tagged as Exploit, so publicly discussed risk should be considered.

Is there a fixed version?

No fixed version is listed in the record. Contact the vendor or distributor for an update or advisory, and restrict network exposure until a fix is confirmed.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.