Critical severity · published Jun 24, 2025
CVE-2025-6559
Sapido Wireless Router - OS Command Injection
9.8
CVSS
1.7%
EPSS
No
On KEV
Description
Multiple wireless router models from Sapido have an OS Command Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary OS commands and execute them on the server. The affected models are out of support; replacing the device is recommended.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.7% · higher than 77% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BR
BR071n · Sapido
0 · source: vendor
BR
BR261c · Sapido
0 · source: vendor
BR
BR270n · Sapido
0 · source: vendor
BR
BR476n · Sapido
0 · source: vendor
BR
BRC70n · Sapido
0 · source: vendor
BR
BRC70x · Sapido
0 · source: vendor
BR
BRC76n · Sapido
0 · source: vendor
BR
BRD70n · Sapido
0 · source: vendor
BR
BRE70n · Sapido
0 · source: vendor
BR
BRE71n · Sapido
0 · source: vendor
BR
BRF61c · Sapido
0 · source: vendor
BR
BRF71n · Sapido
0 · source: vendor