Skip to content
Fencer Vulns
medium 6.2

CVE-2025-13087 json

Command Injection in Opto22 Groov REST API

published 2025-11-20 11 mo ago modified 2026-10-18 21 d ago also EUVD-2025-198362

cvss
6.2
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
7.3%
EPSS 7.3% chance of exploitation in 30 days, percentile 94%
public exploits
0
none known

Summary

A vulnerability exists in the Opto22 Groov Manage REST API on GRV-EPIC and groov RIO Products that allows remote code execution with root privileges. When a POST request is executed against the vulnerable endpoint, the application reads certain header details and unsafely uses these values to build commands, allowing an attacker with administrative privileges to inject arbitrary commands that execute as root.

Patch / fix

  • Opto22 GRV-EPIC-PR1 4.0.3
  • Opto22 GRV-EPIC-PR2 4.0.3
  • Opto22 groov RIO GRV-R7-MM1001-10 4.0.3
  • Opto22 groov RIO GRV-R7-MM2001-10 4.0.3
  • Opto22 groov RIO GRV-R7-I1VAPM-3 4.0.3

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-25-324-03 updated cvss 6.2

Opto 22 GRV-EPIC and groov RIO

  • Opto 22 groov RIO GRV-R7-I1VAPM-3 Firmware <4.0.3 Opto 22 groov RIO GRV-R7-MM1001-10 Firmware <4.0.3 Opto 22 groov RIO GRV-R7-MM2001-10 Firmware <4.0.3 Opto 22 GRV-EPIC-PR1 Firmware <4.0.3 Opto 22 GRV-EPIC-PR2 Firmware <4.0.3
    affected: mitigation “Opto 22 has published a patch to address this vulnerability and recommends that users upgrade to GRV-EPIC and groov RIO Firmware Version 4.0.3. Additional information is available from Opto 22 here.” opto22.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
11 mo ago

Exploit prediction

7.30% chance of exploitation in the next 30 days, higher than 94% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 4.0 7.5 CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
CNA 3.1 6.2 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:L
CNA 4.0 7.5 CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected products

  • Opto22 GRV-EPIC-PR1
  • Opto22 GRV-EPIC-PR2
  • Opto22 groov RIO GRV-R7-MM1001-10
  • Opto22 groov RIO GRV-R7-MM2001-10
  • Opto22 groov RIO GRV-R7-I1VAPM-3

Classification

Weakness
  • CWE-78 Improper Neutralization of Special Elements used in an OS Command

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.