CVE-2025-25053: high-severity vulnerability in Inaba Denki Sangyo Co., Ltd. AC-WPS-11ac
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
A flaw in the Wi-Fi AP UNIT 'AC-WPS-11ac series' settings page allows a logged-in attacker to run any operating system command on the device. This bypasses normal restrictions and gives the attacker full control over the device.
OS command injection vulnerability in the WEB UI settings page of AC-WPS-11ac series allows remote authenticated attackers to execute arbitrary OS commands via unsanitized input parameters. Attack vector is network-based, requires valid login credentials as a pre-condition, and impacts confidentiality, integrity, and availability of the affected device.
In the same product, most dangerous first.