CVE-2025-13087
Medium
Description
A vulnerability exists in the Opto22 Groov Manage REST API on GRV-EPIC and groov RIO Products that allows remote code execution with root privileges. When a POST request is executed against the vulnerable endpoint, the application reads certain header details and unsafely uses these values to build commands, allowing an attacker with administrative privileges to inject arbitrary commands that execute as root.
SeverityMedium
CVSS6.2
Exploit probability—
Productgroov RIO GRV-R7-MM1001-10
PublishedNov 20, 2025
First seenNov 20, 2025
Weakness typeCWE-78OS command injection
How to fix
Update
- Opto22 groov RIO GRV-R7-MM1001-104.0.3 or later
- Opto22 GRV-EPIC-PR14.0.3 or later
- Opto22 GRV-EPIC-PR24.0.3 or later
- Opto22 groov RIO GRV-R7-MM2001-104.0.3 or later
- Opto22 groov RIO GRV-R7-I1VAPM-34.0.3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Opto22 groov RIO GRV-R7-MM1001-10 | v < 4.0.3 | 4.0.3 |
| Opto22 GRV-EPIC-PR1 | v < 4.0.3 | 4.0.3 |
| Opto22 GRV-EPIC-PR2 | v < 4.0.3 | 4.0.3 |
| Opto22 groov RIO GRV-R7-MM2001-10 | v < 4.0.3 | 4.0.3 |
| Opto22 groov RIO GRV-R7-I1VAPM-3 | v < 4.0.3 | 4.0.3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.