Remote Code Execution Vulnerability in QVidium Opera11 Device
CVE-2025-63213

9.8CRITICAL

Key Information:

Vendor

QVidium

Status
Opera11
Vendor
CVE Published:
19 November 2025

What is CVE-2025-63213?

The QVidium Opera11 device is susceptible to Remote Code Execution due to inadequate input validation at the /cgi-bin/net_ping.cgi endpoint. An attacker can exploit this flaw by transmitting a specially crafted GET request that includes a malicious parameter, enabling the injection of arbitrary commands. With these commands executed under root privileges, the attacker can fully compromise the device, raising significant security concerns for systems running this firmware.

References

https://qvidium.tv/
https://undercodetesting.com/zero-day-vulnerabilities-dis...
https://github.com/shiky8/my--cve-vulnerability-research/...

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.