CVE-2025-27797CWE-78

OS command injection vulnerability in the specific service exists in Wi-Fi AP UNIT 'AC-WPS-11ac series'

Critical · published April 9, 2025

CVSS v3.1
9.8
EPSS
1%
Percentile
62.6
In the wild
Unconfirmed
What it is

🚨 A crafty remote attacker just needs a login to unleash arbitrary commands on your Wi-Fi AP UNIT 'AC-WPS-11ac series'! 🔥 Think of it like someone sneaking into your house and rearranging the furniture while you’re obliviously watching TV — it looks normal, but they could easily cause chaos behind the scenes! If this vulnerability is exploited, the attacker could run any command on the system, potentially leading to complete control over your network. This could mean changing settings, stealing sensitive data, or even launching attacks on other connected devices. It's an absolute nightmare waiting to happen!

Put simply

Think of it like someone sneaking into your house and rearranging the furniture while you’re obliviously watching TV — it looks normal, but they could easily cause chaos behind the scenes! This OS command injection vulnerability allows authenticated users to execute arbitrary commands on the appliance by manipulating input. Once logged in, the attacker can perform harmful actions by exploiting this flaw, leaving your network vulnerable.

What to do

If this vulnerability is exploited, the attacker could run any command on the system, potentially leading to complete control over your network. This could mean changing settings, stealing sensitive data, or even launching attacks on other connected devices. It's an absolute nightmare waiting to happen! Immediately update your Wi-Fi AP UNIT to the latest firmware version as soon as the vendor releases a patch. Consider implementing stricter access controls to limit who can log in to the device, and review your network logs for any unauthorized access attempts. 🛡️ You've got this! Act now, and you'll keep your network safe and sound. 😊

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01002 · 62.6th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2025-04-09T09:03Z
EPSS history
Timeline
  • 09 APR 09:03Z
    OS command injection vulnerability in the specific service exists in Wi-Fi AP UNIT 'AC-WPS-11ac series'
    cvelistv5