CVE-2025-11073 Overview
CVE-2025-11073 is a command injection vulnerability affecting the Keyfactor RG-EW5100BE running firmware EW_3.0B11P280_EW5100BE-PRO_12183019. The flaw resides in an unknown function of the file /cgi-bin/luci/api/cmd, part of the HTTP POST Request Handler component. Attackers can manipulate the url argument to inject operating system commands. The issue is categorized under CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component. Exploitation is possible over the network, and public exploit code is available.
Critical Impact
Authenticated remote attackers can inject arbitrary commands through the url parameter of the /cgi-bin/luci/api/cmd endpoint, affecting the confidentiality, integrity, and availability of the device.
Affected Products
- Keyfactor RG-EW5100BE firmware EW_3.0B11P280_EW5100BE-PRO_12183019
- HTTP POST Request Handler component exposing /cgi-bin/luci/api/cmd
- Deployments where the LuCI-based management interface is reachable over the network
Discovery Timeline
- 2025-09-27 - CVE-2025-11073 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-11073
Vulnerability Analysis
The vulnerability lives in the LuCI web API endpoint /cgi-bin/luci/api/cmd. The handler accepts an HTTP POST request that includes a url argument. The device passes this argument to a downstream component without sufficient neutralization of shell metacharacters. As a result, attackers can append shell operators and additional commands that the underlying operating system executes.
The CVSS 4.0 vector indicates a network-reachable attack that requires high privileges and no user interaction. Impact is limited to low confidentiality, integrity, and availability effects on the vulnerable component. The EPSS probability sits at 1.90% with a percentile of 78.333, reflecting elevated attacker interest relative to the broader CVE population. Public proof-of-concept material is referenced in the GitHub CVE Report.
Root Cause
The root cause is improper input neutralization in the CGI handler that processes the url parameter. The application forwards the parameter into a shell context (or a function that ultimately invokes a shell) without validating the character set or escaping metacharacters such as ;, |, &, and backticks. This matches CWE-74, the parent weakness class for injection flaws.
Attack Vector
An attacker who holds valid credentials for the LuCI web interface sends an HTTP POST request to /cgi-bin/luci/api/cmd. The request body contains a url field concatenated with shell metacharacters and an attacker-controlled command. When the device processes the request, the injected command executes in the context of the CGI handler. Because the exploit path is exposed over the network, any reachable LuCI interface, including those inadvertently published to the internet, is at risk.
Detailed request formatting and payload structure are documented in the GitHub CVE PoC and the VulDB Analysis #326113.
Stop Remote Code Execution Before It Runs
Singularity™ Endpoint detects and blocks exploit attempts at machine speed, including zero-days and novel attack techniques.
Stop Exploit AttemptsDetection Methods for CVE-2025-11073
Indicators of Compromise
- HTTP POST requests to /cgi-bin/luci/api/cmd containing shell metacharacters (;, |, &, `, $() inside the url parameter.
- Unexpected child processes spawned by the LuCI CGI handler, such as sh, wget, curl, busybox, or nc.
- Outbound connections from the device to unknown hosts shortly after administrative HTTP POST activity.
Detection Strategies
- Inspect web server and reverse proxy logs for POST requests to /cgi-bin/luci/api/cmd where the url field length or character set deviates from legitimate management traffic.
- Deploy network-based signatures that flag HTTP request bodies targeting /cgi-bin/luci/api/cmd with command injection patterns.
- Correlate authenticated LuCI sessions with subsequent process execution on the device to identify suspicious command chains.
Monitoring Recommendations
- Forward LuCI, CGI, and system logs from RG-EW5100BE devices to a centralized log platform for retention and query.
- Alert on any successful authentication to the LuCI API followed by requests to /cgi-bin/luci/api/cmd from non-administrative source addresses.
- Baseline outbound traffic from network appliances and alert on new destinations, especially those associated with tool downloads or command-and-control infrastructure.
How to Mitigate CVE-2025-11073
Immediate Actions Required
- Restrict access to the LuCI management interface to trusted administrative networks using firewall rules or VLAN segmentation.
- Rotate credentials for all administrative accounts on affected RG-EW5100BE devices, since exploitation requires authenticated access.
- Audit device logs for prior requests to /cgi-bin/luci/api/cmd and investigate any anomalous command execution.
- Disable remote administrative access from untrusted networks until a vendor-supplied fix is verified.
Patch Information
No vendor patch or advisory URL is referenced in the NVD entry at the time of publication. Administrators should monitor the vendor support channels and the VulDB Details #326113 entry for firmware update information. Public exploit details are available in the GitHub CVE Report, so remediation should proceed even without an official patch bulletin.
Workarounds
- Block external access to /cgi-bin/luci/api/cmd at an upstream firewall or reverse proxy while a vendor fix is pending.
- Enforce network access control lists that limit management-plane connectivity to a dedicated administrative subnet.
- Require VPN authentication before any user can reach the LuCI interface, reducing exposure of the authenticated attack surface.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
