Cyber Resilience

CVE-2025-26063

CriticalPublic PoCRCE

Published: 31 July 2025

Published
31 July 2025
Modified
03 November 2025
KEV Added
Patch
CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0342 87.7th percentile
Risk Priority 22 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-26063 is a critical-severity Command Injection (CWE-77) vulnerability in Intelbras Rx 1500 Firmware. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 12.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and SI-10 (Information Input Validation).

Deeper analysis

CVE-2025-26063 is a command injection vulnerability (CWE-77) affecting Intelbras RX1500 version 2.2.9 and RX3000 version 1.0.11. It permits unauthenticated remote attackers to execute arbitrary code by supplying a crafted payload in the ESSID name field when creating a wireless network. The flaw carries a CVSS 3.1 score of 9.8, reflecting network attack vector, low complexity, and no requirements for authentication or user interaction.

An attacker with network reachability to an unpatched device can leverage the injection to run commands with the privileges of the affected process, resulting in complete compromise of confidentiality, integrity, and availability on the router.

Public disclosures on seclists.org reference Intelbras changelogs for the RX1500 and RX3000 lines that address firmware updates, while the EPSS score has remained flat at 0.0342 since publication with no material rise indicating emerging exploitation activity.

EU & UK References

Vulnerability details

An issue in Intelbras RX1500 v2.2.9 and RX3000 v1.0.11 allows unauthenticated attackers to execute arbitrary code via injecting a crafted payload into the ESSID name when creating a network.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1059.004 Unix Shell Execution
Adversaries may abuse Unix shell commands and scripts for execution.
Why these techniques?

Direct unauthenticated command injection RCE on public-facing router firmware enables T1190 (Exploit Public-Facing Application) for initial access and T1059.004 (Unix Shell) for arbitrary command execution.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2025-26062Same product: Intelbras Rx 1500
CVE-2026-3101Same vendor: Intelbras
CVE-2026-4048Shared CWE-77
CVE-2026-31059Shared CWE-77
CVE-2026-22284Shared CWE-77
CVE-2024-39783Shared CWE-77
CVE-2024-57583Shared CWE-77
CVE-2026-46368Shared CWE-77
CVE-2024-39781Shared CWE-77
CVE-2024-39367Shared CWE-77

Affected Assets

intelbras
rx 1500 firmware
2.2.9
intelbras
rx 3000 firmware
1.0.11

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly prevents command injection vulnerabilities like CVE-2025-26063 by requiring validation and sanitization of untrusted inputs such as crafted ESSID names.

prevent

Mandates timely flaw remediation through firmware updates, as Intelbras provided for RX1500 and RX3000 to fix this specific command injection issue.

prevent

Prohibits unauthenticated actions such as network creation with ESSID payloads, directly blocking remote attackers from exploiting the vulnerability without identification or authentication.

References