A backdoor listener on UDP port 53413 allows an unauthenticated remote attacker to execute arbitrary commands on affected Netcore and Netis routers. The flaw results from a hardcoded authentication mechanism; once the backdoor is reached, the device accepts shell commands. Because authentication is not required, any host that exposes UDP 53413 can be compromised. The vulnerability is classified as missing authentication (CWE‑306) and operating system command injection (CWE‑78).

The issue impacts Netcore Technology router firmware and Netis router firmware released before August 2014. Exact model or firmware revision limits are not documented, but any router running the undocumented backdoor will be vulnerable.

With a CVSS score of 9.3, the flaw poses a critical threat to confidentiality, integrity, and availability. An EPSS score of 61 % indicates a high probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, yet its exposure and exploit likelihood demand urgent action. An attacker simply sends specially crafted UDP packets to port 53413; the hardcoded authentication and shell command interface grant immediate code execution once the packet is received.