What is the CVSS score of CVE-2025-48890?

CVE-2025-48890 has a CVSS 3.0 base score of 9.8 (Critical). CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of IoT are affected by CVE-2025-48890?

Critical remote code execution vulnerability affecting WRH-733GBK and WRH-733GWH network devices allows unauthenticated attackers to execute arbitrary commands with no authentication required.

How to fix or mitigate CVE-2025-48890?

Within 24 hours: Identify all WRH-733GBK and WRH-733GWH devices in your environment and isolate them from internet-facing networks. Within 7 days: Implement network segmentation to restrict SOAP service access (port 49152) to authorized administrative networks only and deploy WAF rules blocking malicious SOAP payloads. Within 30 days: Develop device replacement plan with vendor, establish continuous monitoring for suspicious SOAP traffic, and evaluate alternative network solutions to eliminate dependency on vulnerable models.

IoT CVE-2025-48890

EUVD-2025-18996 CRITICAL

OS Command Injection (CWE-78)

2025-06-24 vultures@jpcert.or.jp

Command Injection RCE IoT Netgear

9.8

CVSS 3.0 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 15, 2026 - 22:36 euvd

EUVD-2025-18996

Analysis Generated

Mar 15, 2026 - 22:36 vuln.today

CVE Published

Jun 24, 2025 - 05:15 nvd

CRITICAL 9.8

DescriptionCVE.org

WRH-733GBK and WRH-733GWH contain an improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in miniigd SOAP service. If a remote unauthenticated attacker sends a specially crafted request to the affected product, an arbitrary OS command may be executed.

AnalysisAI

CVE-2025-48890 is a critical OS command injection vulnerability in the miniigd SOAP service affecting WRH-733GBK and WRH-733GWH network storage devices. Remote unauthenticated attackers can execute arbitrary OS commands by sending specially crafted requests, achieving complete system compromise (CVSS 9.8). With an attack vector of Network/Low complexity/No privileges required, this vulnerability poses immediate risk to exposed devices.

Technical ContextAI

The vulnerability exists in the miniigd SOAP service, which handles UPnP/SOAP protocol requests for device management and control. The root cause is CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'), indicating insufficient input validation and sanitization of user-supplied data before passing it to OS command execution functions (likely system(), exec(), or equivalent). The SOAP service likely processes XML requests containing parameters that are directly interpolated into shell commands without proper escaping or parameterization. Affected products are WRH-733GBK (black) and WRH-733GWH (white) variants, which are consumer/prosumer NAS devices. The miniigd daemon typically runs with elevated privileges, amplifying the impact of command injection to full system compromise.

RemediationAI

Immediate remediation steps: (1) Apply firmware patches released by the vendor for WRH-733GBK and WRH-733GWH—check vendor advisory for specific patched firmware versions; (2) If patches are unavailable, disable or restrict network access to the miniigd SOAP service port (typically UDP 1900, TCP 49152-49161) using firewall rules, allowing only trusted administrative networks; (3) Implement network segmentation to isolate NAS devices from untrusted networks; (4) Monitor device logs for suspicious SOAP requests or command injection patterns; (5) If exploitation is suspected, immediately isolate the device and audit for unauthorized access or data exfiltration; (6) Update to latest firmware as soon as vendor releases patched versions. Vendor advisory links and patch download URLs should be obtained directly from the manufacturer's security page or product support portal.