PT-2025-47634 · Opto 22 · Groov Manage Rest Api+2

Ismail Aydemir + 2 · Published 2025-11-20 · Updated 2025-11-25 · CVE-2025-13087

Positive Technologies (AI Summary)

CVSS v3.1

6.2

Medium

Base vector

AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions Opto22 Groov Manage REST API on GRV-EPIC and groov RIO Products (affected versions not specified)

Description A flaw exists in the Opto22 Groov Manage REST API that could allow for remote code execution with root privileges. The issue arises when a POST request is sent to a vulnerable endpoint. The application improperly handles header details from the request, using them to construct commands without sufficient safeguards. This allows an attacker with administrative access to inject and execute arbitrary commands as root. The vulnerable endpoint processes POST requests and utilizes header information to build commands. The vulnerable parameters are within the request headers.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2025-13087

Affected Products

Grv-Epic

Groov Manage Rest Api

Groov Rio

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-13087 · Security Note
• https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-324-03.json · Note
• https://t.me/CVEtracker/37872 · Telegram Post
• https://cisa.gov/news-events/ics-advisories/icsa-25-324-03 · Note
• https://opto22.com/support/resources-tools/knowledgebase/kb91326 · Note
• https://twitter.com/CVEnew/status/1991640312717144472 · Twitter Post
• https://twitter.com/ET_Labs/status/1993432904823972095 · Twitter Post