CVE-2019-25487CWE-639

SAPIDO RB-1732 V2.0.43 Remote Command Execution via formSysCmd

Critical · published March 11, 2026

CVSS v4.0
9.3
EPSS
8%
Percentile
94.8
In the wild
Unconfirmed
What it is

SAPIDO RB-1732 V2.0.43 contains a remote command execution vulnerability that allows unauthenticated attackers to execute arbitrary system commands by submitting malicious input to the formSysCmd endpoint. Attackers can send POST requests with the sysCmd parameter containing shell commands to execute code on the device with router privileges.

The record
Technical detail
CVSS v4.0
9.3 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.08035 · 94.8th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-03-11T18:23Z
EPSS history
Timeline
  • 11 MAR 18:23Z
    SAPIDO RB-1732 V2.0.43 Remote Command Execution via formSysCmd
    cvelistv5