CVE-2025-34103CWE-306CWE-78

WePresent WiPG-1000 Unauthenticated Command Injection in via rdfs.cgi

Critical · published July 15, 2025

CVSS v4.0
9.3
EPSS
6%
Percentile
93.2
In the wild
Unconfirmed
What it is

An unauthenticated command injection vulnerability exists in WePresent WiPG-1000 firmware versions prior to 2.2.3.0, due to improper input handling in the undocumented /cgi-bin/rdfs.cgi endpoint. The Client parameter is not sanitized before being passed to a system call, allowing an unauthenticated remote attacker to execute arbitrary commands as the web server user.

The record
Technical detail
CVSS v4.0
9.3 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.05864 · 93.2th percentile
Weaknesses
CWE-306 · Missing Authentication for Critical Function; CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2025-07-15T13:10Z
EPSS history
Timeline
  • 15 JUL 13:10Z
    WePresent WiPG-1000 Unauthenticated Command Injection in via rdfs.cgi
    cvelistv5