CVE-2025-48890: WRH-733 Router RCE Vulnerability

CVE-2025-48890 Overview

CVE-2025-48890 is an OS command injection vulnerability [CWE-78] affecting Elecom WRH-733GBK and WRH-733GWH wireless routers. The flaw resides in the miniigd SOAP service, which fails to properly neutralize special characters in incoming requests. A remote, unauthenticated attacker can send a crafted SOAP request to the router and execute arbitrary operating system commands. Successful exploitation grants control over the device, enabling traffic interception, lateral movement, and persistent compromise of the local network.

Critical Impact
Unauthenticated remote attackers can execute arbitrary OS commands on affected Elecom routers, leading to full device takeover.

Affected Products

Elecom WRH-733GBK wireless router
Elecom WRH-733GWH wireless router
miniigd SOAP service component

Discovery Timeline

2025-06-24 - CVE-2025-48890 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-48890

Vulnerability Analysis

The vulnerability exists in the miniigd SOAP service, a UPnP Internet Gateway Device daemon commonly exposed on consumer routers. The service accepts SOAP-formatted XML requests over HTTP and parses parameters that are subsequently passed to underlying OS command invocations. Because the input is not sanitized, attacker-supplied data containing shell metacharacters such as ;, |, &, or backticks is interpreted by the shell rather than treated as literal data.

An unauthenticated attacker reachable over the network can send a single crafted SOAP request to trigger arbitrary command execution under the privileges of the miniigd process, typically root on embedded Linux routers. This results in complete loss of confidentiality, integrity, and availability of the device.

Root Cause

The root cause is improper neutralization of special elements used in an OS command [CWE-78]. The miniigd service constructs shell commands by concatenating user-controlled SOAP parameter values without escaping or validation, allowing injected metacharacters to break out of the intended command context.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker sends a specially crafted SOAP/UPnP request to the listening miniigd port on the router. If the service is exposed to the internet through misconfiguration, the attack can be conducted remotely; otherwise, an attacker on the local network or a compromised LAN host can exploit the flaw. Refer to the JVN Vulnerability Report and the Elecom Security Announcement for vendor-specific technical details.

Detection Methods for CVE-2025-48890

Indicators of Compromise

Unexpected outbound connections from the router to unknown IP addresses or domains
Inbound HTTP/SOAP requests to miniigd endpoints containing shell metacharacters such as ;, |, &&, or backticks
New or modified processes running on the router outside of normal firmware behavior
DNS configuration changes or altered routing tables on the affected device

Detection Strategies

Inspect network traffic for SOAP/UPnP requests targeting router management ports containing command separator characters in XML element values
Monitor for anomalous traffic patterns originating from router IP addresses, including scanning behavior or connections to known command-and-control infrastructure
Review router system logs, where available, for unexpected process executions or shell invocations

Monitoring Recommendations

Deploy network sensors at the LAN/WAN boundary to flag UPnP traffic reaching routers from untrusted segments
Alert on internet-exposed UPnP services (typically TCP ports 49152-49154) on consumer-grade equipment
Track firmware versions across managed devices and correlate with vendor advisories

How to Mitigate CVE-2025-48890

Immediate Actions Required

Apply the firmware update published in the Elecom Security Announcement as soon as it is available for the affected models
Disable UPnP/miniigd functionality on the router if it is not required for your environment
Ensure the router's WAN interface does not expose UPnP or SOAP management services to the public internet
Restrict LAN access to the router management interface to trusted hosts only

Patch Information

Elecom has published a security advisory for the WRH-733GBK and WRH-733GWH devices. Consult the Elecom Security Announcement and the JVN Vulnerability Report for the current patch status and firmware download links. Because these models may be end-of-life, replacement with a supported router is recommended where no patch is available.

Workarounds

Disable UPnP services on the router via the administrative web interface
Place vulnerable routers behind a separate firewall or upstream gateway that blocks unsolicited inbound SOAP/UPnP traffic
Segment the network so that untrusted devices cannot reach the router's miniigd listener
Replace end-of-life hardware with a currently supported model that receives security updates