CVE-2025-29534

HighRCE

Published: 28 July 2025

Published

28 July 2025

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0070 72.1th percentile

Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-29534 is a high-severity OS Command Injection (CWE-78) vulnerability in Wave Dual-Band Wifi (inferred from references). Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 27.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match

prevent

SI-10 directly addresses the insufficient sanitization of user-supplied input in the CGI script by requiring validation at external interfaces, preventing OS command injection.

SI-2 Flaw Remediation good match

prevent

SI-2 requires timely remediation of the specific software flaw in /cgi-bin/cgi_vista.cgi that enables authenticated RCE with root privileges.

AC-6 Least Privilege partial match

prevent

AC-6 enforces least privilege, limiting the damage from command injection by preventing the CGI process from executing system calls with unnecessary root privileges.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1059.004 Unix Shell Execution

Adversaries may abuse Unix shell commands and scripts for execution.

attack.mitre.org →

Why these techniques?

Authenticated OS command injection in public-facing CGI binary directly enables remote code execution on network device.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

An authenticated remote code execution vulnerability in PowerStick Wave Dual-Band Wifi Extender V1.0 allows an attacker with valid credentials to execute arbitrary commands with root privileges. The issue stems from insufficient sanitization of user-supplied input in the /cgi-bin/cgi_vista.cgi executable, which…

is passed to a system-level function call.

Deeper analysisAI

CVE-2025-29534 is an authenticated remote code execution vulnerability in the PowerStick Wave Dual-Band Wifi Extender V1.0. The issue originates from insufficient sanitization of user-supplied input in the /cgi-bin/cgi_vista.cgi executable, which is passed directly to a system-level function call, enabling OS command injection as classified under CWE-78. Published on 2025-07-28, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact.

An attacker with valid credentials can exploit this vulnerability remotely over the network with low attack complexity and no user interaction required. Upon successful exploitation, the attacker gains the ability to execute arbitrary commands with root privileges on the affected device, compromising confidentiality, integrity, and availability to a high degree.

References for advisories and further details include the vendor site at http://wave.com and a GitHub gist at https://gist.github.com/EmptyButter/19b2c626f4589d1f9d4478632205a9eb.