Critical 10.0Published Dec 26, 2025

CVE-2025-54322Xspeeder SXZOS through 2025-12-26 allows root remote code execution via base64-encoded Python code in the chkid parameter to vLogin.py.

Updated under an hour ago (Oct 27, 2026, 11:10 PM ET)

Does this affect you?

It affects Xspeeder SXZOS. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Xspeeder SXZOS

Exploited in the last 30 days

Xspeeder SXZOS through 2025-12-26 allows root remote code execution via base64-encoded Python code in the chkid parameter to vLogin.py. The title and oIP parameters are also used.

CVSS: 10.0 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Weakness (CWE): CWE-95
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: mitre
NVD analysis: Analyzed
Record last updated: Dec 29, 2025
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Xspeeder SXZOS xspeeder:sxzos (from the name)	through 2025-12-26	CNA record
xspeeder sxzos xspeeder:sxzos	through 2025-12-26	NVD

References

References

https://www.xspeeder.com	product
https://pwn.ai/blog/cve-2025-54322-zeroday-unauthenticated-root-rce-affecting-70-000-hosts	exploit, third-party-advisory

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.