CVE-2025-25053
Published: 09 April 2025
Summary
CVE-2025-25053 is a high-severity OS Command Injection (CWE-78) vulnerability in Jvn (inferred from references). Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 22.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2025-25053 is an OS command injection vulnerability (CWE-78) residing in the web UI settings page of the Wi-Fi AP UNIT AC-WPS-11ac series. The flaw permits an authenticated remote attacker to supply crafted input that is executed directly by the underlying operating system, resulting in a CVSS 3.1 score of 8.8 with network attack vector, low complexity, and no user interaction required.
An attacker who already possesses valid credentials can exploit the issue to run arbitrary operating-system commands on the affected access point. Successful exploitation grants full control over confidentiality, integrity, and availability of the device, allowing actions such as configuration changes, data exfiltration, or deployment of persistent malware.
Vendor advisories published by Inaba and coordinated through JVN recommend applying the fixes referenced in the April 2025 security bulletin and restricting administrative access to trusted networks until patches are installed. The associated EPSS scores have remained low and stable near 0.01 with no material increase after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-10420
Vulnerability details
OS command injection vulnerability in the WEB UI (the setting page) exists in Wi-Fi AP UNIT 'AC-WPS-11ac series'. If exploited, an arbitrary OS command may be executed by a remote attacker who can log in to the product.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.