CVE-2019-25487

SAPIDO RB-1732 V2.0.43 contains a remote command execution vulnerability that allows unauthenticated attackers to execute arbitrary system commands by submitting malicious input to the formSysCmd endpoint. Attackers can send POST requests with the sysCmd parameter containing shell commands to execute code on the device with router privileges.

CVSS v4.0

9.3 CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS v3.1

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

7.90% chance of exploitation in the next 30 days, 94th percentile

Published

2026-03-11

Updated

2026-07-15

Proof-of-concept exploits (1)

• https://www.exploit-db.com/exploits/47031

References

• CVE Record
• NVD entry

Related

• CVE-2019-25486
• CVE-2019-25488
• CVE-2019-25485
• CVE-2019-25489
• CVE-2019-25484
• CVE-2019-25490