Command Injection in Opto22 Groov REST API
Priority MEDIUM 45CWE-78Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- High
- Attack requirements
- None
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · Low
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-78.
Summary
A vulnerability exists in the Opto22 Groov Manage REST API on GRV-EPIC and groov RIO Products that allows remote code execution with root privileges. When a POST request is executed against the vulnerable endpoint, the application reads certain header details and unsafely uses these values to build commands, allowing an attacker with administrative privileges to inject arbitrary commands that execute as root.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.07299 94th percentileScored 2026-11-07
Fix Fixed GRV-EPIC-PR1 (Opto22): 4.0.3GRV-EPIC-PR2 (Opto22): 4.0.3+3 more products
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| OPTO 22 | GRV-EPIC-PR1 | before 4.0.3 | 4.0.3 | Patch available | CNA |
| OPTO 22 | GRV-EPIC-PR2 | before 4.0.3 | 4.0.3 | Patch available | CNA |
| OPTO 22 | groov RIO GRV-R7-MM1001-10 | before 4.0.3 | 4.0.3 | Patch available | CNA |
| OPTO 22 | groov RIO GRV-R7-MM2001-10 | before 4.0.3 | 4.0.3 | Patch available | CNA |
| OPTO 22 | groov RIO GRV-R7-I1VAPM-3 | before 4.0.3 | 4.0.3 | Patch available | CNA |
- GRV-EPIC-PR1 VendorOPTO 22 Affected before 4.0.3 Fixed in 4.0.3 Patch available CNA
- GRV-EPIC-PR2 VendorOPTO 22 Affected before 4.0.3 Fixed in 4.0.3 Patch available CNA
- groov RIO GRV-R7-MM1001-10 VendorOPTO 22 Affected before 4.0.3 Fixed in 4.0.3 Patch available CNA
- groov RIO GRV-R7-MM2001-10 VendorOPTO 22 Affected before 4.0.3 Fixed in 4.0.3 Patch available CNA
- groov RIO GRV-R7-I1VAPM-3 VendorOPTO 22 Affected before 4.0.3 Fixed in 4.0.3 Patch available CNA
Remediation
- Fix · CNA GRV-EPIC-PR1 (Opto22) Fixed in 4.0.3
- Fix · CNA GRV-EPIC-PR2 (Opto22) Fixed in 4.0.3
- Fix · CNA groov RIO GRV-R7-MM1001-10 (Opto22) Fixed in 4.0.3
- Fix · CNA groov RIO GRV-R7-MM2001-10 (Opto22) Fixed in 4.0.3
- Fix · CNA groov RIO GRV-R7-I1VAPM-3 (Opto22) Fixed in 4.0.3
Timeline
- 2026-10-02 Threatist record created from CVE-2025-13087
References
More OPTO 22 vulnerabilities
- TI-2015-00918 Stack-based buffer overflow in OPTO 22 PAC Project Professional CVSS 3.0CRITICAL 9.8
- TI-2023-21491 Improper Restriction of Excessive Authentication Attempts in OPTO 22 SNAP PAC S1 Built-in Web Server CVSS 3.1CRITICAL 9.8
- TI-2018-10637 Stack-based buffer overflow in OPTO 22 PAC Control Basic and PAC Control Professional CVSS 3.1CRITICAL 9.8
- TI-2023-21492 Weak password requirements in OPTO 22 SNAP PAC S1 Built-in Web Server CVSS 3.1HIGH 8.6
- TI-2020-08532 Improper authorization in Opto 22 SoftPAC Project CVSS 3.1CRITICAL 9.8
- TI-2020-08528 Uncontrolled search path in Opto 22 SoftPAC Project CVSS 3.1HIGH 8.8
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences