What’s Vulnerable › Vulnerabilities

CVE-2019-25487: SAPIDO RB-1732 V2.0.43 Remote Command Execution via formSysCmd

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 8.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-03-11 · updated 2026-06-17
• Weakness: CWE-639

Description

SAPIDO RB-1732 V2.0.43 contains a remote command execution vulnerability that allows unauthenticated attackers to execute arbitrary system commands by submitting malicious input to the formSysCmd endpoint. Attackers can send POST requests with the sysCmd parameter containing shell commands to execute code on the device with router privileges.

Affected products

• Sapido RB-1732: 2.0.43

References

• https://www.exploit-db.com/exploits/47031
• https://www.vulncheck.com/advisories/sapido-rb-1732-remote-command-execution-via-formsyscmd

Get alerted when CVE-2019-25487 or the next vulnerability affects your stack