Riskcovery

CVE-2025-13087

Command Injection in Opto22 Groov REST API

State
Published
Severity
7.5 High
Published
Nov 20, 2025
Updated
Nov 21, 2025
Reserved
Nov 12, 2025

Read the record on cve.org

Description

A vulnerability exists in the Opto22 Groov Manage REST API on GRV-EPIC and groov RIO Products that allows remote code execution with root privileges. When a POST request is executed against the vulnerable endpoint, the application reads certain header details and unsafely uses these values to build commands, allowing an attacker with administrative privileges to inject arbitrary commands that execute as root.

Scores

CVSSScoreVectorSource
4.07.5 HighCVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:Nicscert
3.16.2 MediumCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:Licscert

Weaknesses

  • CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Affected Products

ProductVersions
GRV-EPIC-PR1Opto22
  • before 4.0.3Affected
GRV-EPIC-PR2Opto22
  • before 4.0.3Affected
groov RIO GRV-R7-MM1001-10Opto22
  • before 4.0.3Affected
groov RIO GRV-R7-MM2001-10Opto22
  • before 4.0.3Affected
groov RIO GRV-R7-I1VAPM-3Opto22
  • before 4.0.3Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.