CVE-2025-22912

CVE-2025-22912, published on 2025-01-16, is a command injection vulnerability (CWE-77) in RE11S version 1.11, specifically via the /goform/formAccept component. The flaw carries a CVSS v3.1 base score of 9.8 (Critical), reflecting its network accessibility, low attack complexity, lack of required privileges or user interaction, and high potential impact on confidentiality, integrity, and availability.

A remote, unauthenticated attacker can exploit this vulnerability over the network by sending crafted requests to the affected component, enabling arbitrary command injection and execution on the target system. Exploitation requires no prior access or user involvement, potentially allowing full remote code execution and system compromise.

Mitigation details are available in advisories and resources linked from http://re11s.com, https://github.com/xyqer1/RE11S_1.11-formAccept-CommandInjection, and https://www.edimax.com/edimax/global/. Security practitioners should consult these references for vendor patches, workarounds, or updated firmware for RE11S devices.