OS Command Injection Vulnerability in WRH-733GBK and WRH-733GWH Products by Elecom
CVE-2025-48890

9.3CRITICAL

Key Information:

Vendor

Elecom Co.,ltd.

Status
Wrh-733gbk
Wrh-733gwh
Vendor
CVE Published:
24 June 2025

What is CVE-2025-48890?

An OS Command Injection vulnerability exists in the miniigd SOAP service of Elecom's WRH-733GBK and WRH-733GWH devices. This flaw allows an unauthenticated remote attacker to execute arbitrary operating system commands by sending specially crafted requests to the affected products. Exploiting this vulnerability could lead to unauthorized control over the system, potentially compromising its integrity and confidentiality.

Affected Version(s)

WRH-733GBK all versions

WRH-733GWH all versions

References

https://www.elecom.co.jp/news/security/20250624-02/
https://jvn.jp/en/jp/JVN39435597/

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

CVSS V3.0

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-48890 : OS Command Injection Vulnerability in WRH-733GBK and WRH-733GWH Products by Elecom