Critical severity · published Jan 12, 2026
CVE-2025-69269
Spectrum command injection in NCM service
9.8
CVSS
0.9%
EPSS
No
On KEV
Description
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Broadcom DX NetOps Spectrum on Windows, Linux allows OS Command Injection.This issue affects DX NetOps Spectrum: 23.3.6 and earlier.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 59% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DN
DX NetOps Spectrum · Broadcom
23.3.6 and earlier · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-69269
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-69269
Vendor Advisory
https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36756
More from DX NetOps Spectrum
9.8
CVE-2025-69270
Spectrum session token in URL
8.8
CVE-2025-69276
Spectrum insecure deserialiation
8.8
CVE-2025-69274
Spectrum broken authorization scheme
7.5
CVE-2025-69273
Spectrum broken authentication
7.5
CVE-2025-69272
Spectrum password returned in clear