CVE-2025-13084: Opto 22 groov View Exposure of Sensitive Information Through Metadata

Severity: high (CVSS 7.6 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-11-26 · updated 2026-10-18
Weakness: CWE-1230

Description

The users endpoint in the groov View API returns a list of all users and associated metadata including their API keys. This endpoint requires an Editor role to access and will display API keys for all users, including Administrators.

Affected products

Opto 22 groov View Server: from R1.0a through R4.5d
Opto 22 GRV-EPIC-PR1 Firmware: through 4.0.3
Opto 22 GRV-EPIC-PR2 Firmware: through 4.0.3

References

https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-329-04.json
https://www.cisa.gov/news-events/ics-advisories/icsa-25-329-04
https://www.opto22.com/support/resources-tools/knowledgebase/kb91325

Get alerted when CVE-2025-13084 or the next vulnerability affects your stack