CVE-2025-43879CWE-78

WRH-733GBK and WRH-733GWH contain an improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in the telnet…

Critical · published June 24, 2025

CVSS v4.0
9.3
EPSS
2%
Percentile
82.0
In the wild
Unconfirmed
What it is

🚨 A crafty remote attacker can execute any command they want with just a specially crafted request! 🔥 Think of it like a faulty intercom system at a secure facility, where a stranger can call in and request access to any room, bypassing all security checks. They just need to say the right words and poof, they’re inside! This OS command injection vulnerability is absolutely devastating. If exploited, an attacker could gain full control over the operating system, leading to data theft, unauthorized access to sensitive information, or even total system failure. The potential for chaos is immense!

Put simply

Think of it like a faulty intercom system at a secure facility, where a stranger can call in and request access to any room, bypassing all security checks. They just need to say the right words and poof, they’re inside! The vulnerability resides in the telnet function of the WRH-733GBK and WRH-733GWH models, allowing unauthenticated remote attackers to execute arbitrary OS commands due to improper handling of special elements in input requests.

What to do

This OS command injection vulnerability is absolutely devastating. If exploited, an attacker could gain full control over the operating system, leading to data theft, unauthorized access to sensitive information, or even total system failure. The potential for chaos is immense! Immediate action is crucial! Update to the latest firmware provided by the manufacturer to close this vulnerability. Additionally, consider disabling the telnet function if it's not needed, and limit network access to trusted devices only. 🛡️ You’ve got this! With these steps, you’ll lock down your system and keep those pesky attackers at bay! 💪✨

The record
Technical detail
CVSS v4.0
9.3 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.02158 · 82.0th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2025-06-24T04:37Z
EPSS history
Timeline
  • 24 JUN 04:37Z
    WRH-733GBK and WRH-733GWH contain an improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in the telnet…
    cvelistv5