CVE-2025-63213

Critical

Published: 19/11/2025(UTC)Translated: 05/08/2026(UTC)NVD NIST

Summary

The QVidium Opera11 device (firmware 2.9.0-Ax4x-opera11) is vulnerable to Remote Code Execution (RCE) due to improper input validation on the /cgi-bin/net_ping.cgi endpoint. An attacker can inject arbitrary commands via a crafted GET request, executed with root privileges.

Risk Assessment

An attacker can gain full control of the device, potentially compromising network integrity and critical infrastructure.

Recommendation

Apply firmware updates from the vendor and restrict access to the administrative interface.

Original NVD description (English source)

The QVidium Opera11 device (firmware version 2.9.0-Ax4x-opera11) is vulnerable to Remote Code Execution (RCE) due to improper input validation on the /cgi-bin/net_ping.cgi endpoint. An attacker can exploit this vulnerability by sending a specially crafted GET request with a malicious parameter to inject arbitrary commands. These commands are executed with root privileges, allowing attackers to gain full control over the device. This poses a significant security risk to any device running this software.