CVE-2025-11073mediumCWE-74 CWE-77

CVE-2025-11073: medium-severity vulnerability in Keyfactor RG-EW5100BE

Keyfactor RG-EW5100BE HTTP POST Request cmd command injection

Published 27 Sep 2025 · Updated 29 Sep 2025

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.1epss 1.7%

A vulnerability was detected in Keyfactor RG-EW5100BE EW_3.0B11P280_EW5100BE-PRO_12183019. The affected element is an unknown function of the file /cgi-bin/luci/api/cmd of the component HTTP POST Request Handler. The manipulation of the argument url results in command injection. The attack can be launched remotely. The exploit is now public and may be used.

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

Affected products

Keyfactor · RG-EW5100BE

References

https://github.com/s1nec-1o/cve/blob/main/cve-report.md https://github.com/s1nec-1o/cve/blob/main/cve-report.md#poc https://vuldb.com/?ctiid.326113 https://vuldb.com/?id.326113 https://vuldb.com/?submit.659933