CVE-2019-25487
Remote Command Execution in SAPIDO RB-1732 Router Firmware
Publication date: 2026-03-11
Last updated on: 2026-03-11
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| sapido | rb-1732 | 2.0.43 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-639 | The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The SAPIDO RB-1732 router, specifically firmware version V2.0.43, contains a remote command execution vulnerability. This flaw allows unauthenticated attackers to execute arbitrary system commands on the device by sending specially crafted HTTP POST requests to the /goform/formSysCmd endpoint. The attacker includes shell commands in the sysCmd parameter, which the router executes with router-level privileges, enabling full control over the device.
How can this vulnerability impact me? :
This vulnerability can have severe impacts as it allows attackers to remotely execute any command on the affected router without authentication. This means an attacker can fully compromise the device, potentially gaining control over network traffic, stealing sensitive information, disrupting network services, or using the router as a foothold for further attacks within the network.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability can be detected by sending a specially crafted HTTP POST request to the router\'s /goform/formSysCmd endpoint. The POST request should include parameters such as sysCmd (the command to execute), apply set to "Apply", submit-url set to "/syscmd.asp", and an empty msg field.'}, {'type': 'paragraph', 'content': "A practical detection method is to use a script or command that sends this POST request with a harmless command (e.g., 'id' or 'whoami') in the sysCmd parameter and then checks the response for command output."}, {'type': 'paragraph', 'content': 'For example, using curl, you can run a command like:'}, {'type': 'list_item', 'content': 'curl -X POST http://[target-ip]/goform/formSysCmd -d "sysCmd=id&apply=Apply&submit-url=/syscmd.asp&msg="'}, {'type': 'paragraph', 'content': 'If the response contains the output of the command (such as user or group information), the device is vulnerable.'}, {'type': 'paragraph', 'content': 'Alternatively, a Python script using the requests library can automate this detection by sending the POST request and parsing the response for command execution results.'}] [1]
What immediate steps should I take to mitigate this vulnerability?
I don't know