CVE-2025-63213

CRITICAL 9.8CVE-2025-63213 · Published 19/11/2025 · updated 17/06/2026

In short

CVE-2025-63213 is a CRITICAL (CVSS 9.8) vulnerability.
Chance of exploitation in the next 30 days (EPSS): 0.95%, higher than 61.1% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
—	No affected product versions are listed for this vulnerability yet.

Description

The QVidium Opera11 device (firmware version 2.9.0-Ax4x-opera11) is vulnerable to Remote Code Execution (RCE) due to improper input validation on the /cgi-bin/net_ping.cgi endpoint. An attacker can exploit this vulnerability by sending a specially crafted GET request with a malicious parameter to inject arbitrary commands. These commands are executed with root privileges, allowing attackers to gain full control over the device. This poses a significant security risk to any device running this software.

References

shiky8/my--cve-vulnerability-research · Exploit
qvidium.tv · Product
undercodetesting.com/zero-day-vulnerabilities-discovered-in-qvidium-opera11-remote-code-execution-rce-exploit · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free