CVE-2025-63213

CVE-2025-63213 is a critical Remote Code Execution (RCE) vulnerability in the QVidium Opera11 device running firmware version 2.9.0-Ax4x-opera11. It arises from improper input validation (CWE-20) in the /cgi-bin/net_ping.cgi endpoint, earning a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Published on 2025-11-19, the flaw allows attackers to inject and execute arbitrary commands directly on the device.

An unauthenticated remote attacker can exploit this vulnerability over the network with low complexity and no user interaction required. By sending a specially crafted GET request with a malicious parameter to the vulnerable endpoint, the attacker triggers command injection executed with root privileges, resulting in full control over the device and significant security risks to affected systems.

Advisories and further details are available through referenced sources, including the vendor site at https://qvidium.tv/, a proof-of-concept repository at https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-63213_QVidium%20Opera11%20RCE, and an analysis at https://undercodetesting.com/zero-day-vulnerabilities-discovered-in-qvidium-opera11-remote-code-execution-rce-exploit/. These provide exploit demonstrations but no specific patch or mitigation steps are detailed in the initial CVE description.