CVE-2025-11073

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-11073", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2025-09-26T12:49:32.473Z", "datePublished": "2025-09-27T18:02:05.180Z", "dateUpdated": "2025-09-29T19:29:55.504Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2025-09-27T18:02:05.180Z"}, "title": "Keyfactor RG-EW5100BE HTTP POST Request cmd command injection", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-77", "lang": "en", "description": "Command Injection"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-74", "lang": "en", "description": "Injection"}]}], "affected": [{"vendor": "Keyfactor", "product": "RG-EW5100BE", "versions": [{"version": "EW_3.0B11P280_EW5100BE-PRO_12183019", "status": "affected"}], "modules": ["HTTP POST Request Handler"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was detected in Keyfactor RG-EW5100BE EW_3.0B11P280_EW5100BE-PRO_12183019. The affected element is an unknown function of the file /cgi-bin/luci/api/cmd of the component HTTP POST Request Handler. The manipulation of the argument url results in command injection. The attack can be launched remotely. The exploit is now public and may be used."}, {"lang": "de", "value": "Es wurde eine Schwachstelle in Keyfactor RG-EW5100BE EW_3.0B11P280_EW5100BE-PRO_12183019 entdeckt. Betroffen ist eine unbekannte Verarbeitung der Datei /cgi-bin/luci/api/cmd der Komponente HTTP POST Request Handler. Die Manipulation des Arguments url f\u00fchrt zu command injection. Es ist m\u00f6glich, den Angriff aus der Ferne durchzuf\u00fchren. Der Exploit ist \u00f6ffentlich verf\u00fcgbar und k\u00f6nnte genutzt werden."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.1, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 4.7, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 4.7, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 5.8, "vectorString": "AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "timeline": [{"time": "2025-09-26T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2025-09-26T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2025-09-26T14:54:37.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "s1nec (VulDB User)", "type": "reporter"}], "references": [{"url": "https://vuldb.com/?id.326113", "name": "VDB-326113 | Keyfactor RG-EW5100BE HTTP POST Request cmd command injection", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.326113", "name": "VDB-326113 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.659933", "name": "Submit #659933 | Ruijie RG-EW5100BE - EW_3.0B11P280_EW5100BE-PRO_12183019 - Command Injection", "tags": ["third-party-advisory"]}, {"url": "https://github.com/s1nec-1o/cve/blob/main/cve-report.md", "tags": ["related"]}, {"url": "https://github.com/s1nec-1o/cve/blob/main/cve-report.md#poc", "tags": ["exploit"]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-09-29T19:29:46.214526Z", "id": "CVE-2025-11073", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-29T19:29:55.504Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-11073", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-09-29T19:29:46.214526Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-29T19:29:51.478Z"}}], "cna": {"title": "Keyfactor RG-EW5100BE HTTP POST Request cmd command injection", "credits": [{"lang": "en", "type": "reporter", "value": "s1nec (VulDB User)"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.1, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 4.7, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 4.7, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 5.8, "vectorString": "AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "affected": [{"vendor": "Keyfactor", "modules": ["HTTP POST Request Handler"], "product": "RG-EW5100BE", "versions": [{"status": "affected", "version": "EW_3.0B11P280_EW5100BE-PRO_12183019"}]}], "timeline": [{"lang": "en", "time": "2025-09-26T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2025-09-26T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2025-09-26T14:54:37.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/?id.326113", "name": "VDB-326113 | Keyfactor RG-EW5100BE HTTP POST Request cmd command injection", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.326113", "name": "VDB-326113 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.659933", "name": "Submit #659933 | Ruijie RG-EW5100BE - EW_3.0B11P280_EW5100BE-PRO_12183019 - Command Injection", "tags": ["third-party-advisory"]}, {"url": "https://github.com/s1nec-1o/cve/blob/main/cve-report.md", "tags": ["related"]}, {"url": "https://github.com/s1nec-1o/cve/blob/main/cve-report.md#poc", "tags": ["exploit"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was detected in Keyfactor RG-EW5100BE EW_3.0B11P280_EW5100BE-PRO_12183019. The affected element is an unknown function of the file /cgi-bin/luci/api/cmd of the component HTTP POST Request Handler. The manipulation of the argument url results in command injection. The attack can be launched remotely. The exploit is now public and may be used."}, {"lang": "de", "value": "Es wurde eine Schwachstelle in Keyfactor RG-EW5100BE EW_3.0B11P280_EW5100BE-PRO_12183019 entdeckt. Betroffen ist eine unbekannte Verarbeitung der Datei /cgi-bin/luci/api/cmd der Komponente HTTP POST Request Handler. Die Manipulation des Arguments url f\u00fchrt zu command injection. Es ist m\u00f6glich, den Angriff aus der Ferne durchzuf\u00fchren. Der Exploit ist \u00f6ffentlich verf\u00fcgbar und k\u00f6nnte genutzt werden."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-77", "description": "Command Injection"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-74", "description": "Injection"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2025-09-27T18:02:05.180Z"}}}, "cveMetadata": {"cveId": "CVE-2025-11073", "state": "PUBLISHED", "dateUpdated": "2025-09-29T19:29:55.504Z", "dateReserved": "2025-09-26T12:49:32.473Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2025-09-27T18:02:05.180Z", "assignerShortName": "VulDB"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"modules": ["HTTP POST Request Handler"], "product": "RG-EW5100BE", "vendor": "Keyfactor", "versions": [{"status": "affected", "version": "EW_3.0B11P280_EW5100BE-PRO_12183019"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was detected in Keyfactor RG-EW5100BE EW_3.0B11P280_EW5100BE-PRO_12183019. The affected element is an unknown function of the file /cgi-bin/luci/api/cmd of the component HTTP POST Request Handler. The manipulation of the argument url results in command injection. The attack can be launched remotely. The exploit is now public and may be used."}, {"lang": "es", "value": "Una vulnerabilidad fue detectada en Keyfactor RG-EW5100BE EW_3.0B11P280_EW5100BE-PRO_12183019. El elemento afectado es una funci\u00f3n desconocida del archivo /cgi-bin/luci/API/cmd del componente Manejador de Solicitudes POST HTTP. La manipulaci\u00f3n del argumento url resulta en inyecci\u00f3n de comandos. El ataque puede ser lanzado remotamente. El exploit es ahora p\u00fablico y puede ser usado."}], "id": "CVE-2025-11073", "lastModified": "2026-10-09T10:10:00.193", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "MULTIPLE", "availabilityImpact": "PARTIAL", "baseScore": 5.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:M/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 6.4, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 3.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.0, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-11073", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-09-29T19:29:46.214526Z", "version": "2.0.3"}}]}, "published": "2025-09-27T18:15:36.253", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/s1nec-1o/cve/blob/main/cve-report.md"}, {"source": "cna@vuldb.com", "url": "https://github.com/s1nec-1o/cve/blob/main/cve-report.md#poc"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?ctiid.326113"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?id.326113"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?submit.659933"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-74"}, {"lang": "en", "value": "CWE-77"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"created": "2025-09-29T09:29:38.629314+00:00", "updated": "2025-09-29T09:29:38.629379+00:00", "vendors": ["keyfactor", "keyfactor$PRODUCT$rg-ew5100be"]}