CVE-2025-22905

CVE-2025-22905 is a command injection vulnerability in RE11S version 1.11, exploitable via the command parameter at the /goform/mp endpoint. This issue, mapped to CWE-94, affects the RE11S software and carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), marking it as critical due to its potential for severe impact.

Unauthenticated remote attackers with network access can exploit this vulnerability with low attack complexity and no user interaction. Successful exploitation allows arbitrary command injection, enabling high confidentiality, integrity, and availability impacts, such as full system compromise.

Mitigation guidance and additional details are available through vendor-related references, including http://re11s.com and https://www.edimax.com/edimax/global/. A proof-of-concept demonstrating the command injection is published at https://github.com/xyqer1/RE11S_1.11-mp-CommandInjection.