CVE-2025-13087

MEDIUM

Opto22 GRV-EPIC and groov RIO < 4.0.3 - Authenticated Remote Code Execution via REST API Header Injection

Title source: llm
STIX 2.1

Description

A vulnerability exists in the Opto22 Groov Manage REST API on GRV-EPIC and groov RIO Products that allows remote code execution with root privileges. When a POST request is executed against the vulnerable endpoint, the application reads certain header details and unsafely uses these values to build commands, allowing an attacker with administrative privileges to inject arbitrary commands that execute as root.

References (3)

Core 3

Scores

CVSS v3 6.2
EPSS 0.0631
EPSS Percentile 92.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:L

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-78
Status published
Products (5)
Opto22/groov RIO GRV-R7-I1VAPM-3 < 4.0.3
Opto22/groov RIO GRV-R7-MM1001-10 < 4.0.3
Opto22/groov RIO GRV-R7-MM2001-10 < 4.0.3
Opto22/GRV-EPIC-PR1 < 4.0.3
Opto22/GRV-EPIC-PR2 < 4.0.3
Published Nov 20, 2025
Tracked Since Feb 18, 2026