What is the CVSS score of CVE-2025-65882?

CVE-2025-65882 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.6%.

Which versions of Openmptcprouter are affected by CVE-2025-65882?

OpenMPTCProuter versions 0.64 and earlier contain an OS command injection vulnerability in the firmware upgrade helper, enabling remote arbitrary file write and command execution.. A patch is available.

Is there a public PoC exploit available for CVE-2025-65882?

Yes, a public proof-of-concept exploit is available for CVE-2025-65882. Prioritise patching immediately. EPSS: 0.6%.

How to fix or mitigate CVE-2025-65882?

Within 24 hours: identify all OpenMPTCProuter instances in production and document those running version 0.64 or earlier. Within 7 days: apply the vendor-released patch (available via upstream commit in the OpenMPTCProuter repository) to all affected systems. Within 30 days: verify patch deployment across all production instances and establish configuration controls to prevent regression.

Openmptcprouter CVE-2025-65882

CRITICAL

OS Command Injection (CWE-78)

2025-12-09 cve@mitre.org

Command Injection Openmptcprouter

9.8

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (mitre) · only source for this CVE.

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 05, 2026 - 03:19 vuln.today

DescriptionCVE.org

An issue was discovered in openmptcprouter thru 0.64 in file common/package/utils/sys-upgrade-helper/src/tools/sysupgrade.c in function create_xor_ipad_opad allowing attackers to potentially write arbitrary files or execute arbitrary commands.

AnalysisAI

OS command injection in OpenMPTCProuter through version 0.64 lets attackers write arbitrary files or execute arbitrary commands via the create_xor_ipad_opad function in the sysupgrade helper (common/package/utils/sys-upgrade-helper/src/tools/sysupgrade.c). Publicly available exploit code exists (published as a GitHub gist), and a vendor fix is available as an upstream commit; the flaw is not listed in CISA KEV and carries a modest EPSS of 0.59% (44th percentile), indicating no confirmed active exploitation at time of analysis. The submitted CVSS of 9.8 assumes remote unauthenticated access, but because the vulnerable code path is a firmware-upgrade helper, real-world exploitation likely depends on access to the router's upgrade functionality — verify against your deployment.