CVE-2025-6559

Sapido Wireless Router - OS Command Injection

State: Published
Severity: 9.3 Critical
Published: Jun 24, 2025
Updated: Jun 24, 2025
Reserved: Jun 24, 2025

Description

Multiple wireless router models from Sapido have an OS Command Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary OS commands and execute them on the server. The affected models are out of support; replacing the device is recommended.

Scores

CVSS	Score	Vector	Source
4.0	9.3 Critical	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N	twcert
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	twcert

Weaknesses

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Affected Products

Product	Versions
BR071nSapido	0Affected
BR261cSapido	0Affected
BR270nSapido	0Affected
BR476nSapido	0Affected
BRC70nSapido	0Affected
BRC70xSapido	0Affected
BRC76nSapido	0Affected
BRD70nSapido	0Affected
BRE70nSapido	0Affected
BRE71nSapido	0Affected
BRF61cSapido	0Affected
BRF71nSapido	0Affected

References

https://www.twcert.org.tw/tw/cp-132-10196-898d3-1.htmlthird-party-advisory
https://www.twcert.org.tw/en/cp-139-10195-69da1-2.htmlthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.