CVE-2025-25053

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

OS command injection vulnerability in the WEB UI (the setting page) exists in Wi-Fi AP UNIT 'AC-WPS-11ac series'. If exploited, an arbitrary OS command may be executed by a remote attacker who can log in to the product.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
Inaba Denki Sangyo Co., Ltd.	AC-WPS-11ac	v2.0.03P and earlier
Inaba Denki Sangyo Co., Ltd.	AC-WPS-11ac-P	v2.0.03P and earlier
Inaba Denki Sangyo Co., Ltd.	AC-WPSM-11ac	v2.0.03P and earlier
Inaba Denki Sangyo Co., Ltd.	AC-WPSM-11ac-P	v2.0.03P and earlier
Inaba Denki Sangyo Co., Ltd.	AC-PD-WPS-11ac	v2.0.03P and earlier
Inaba Denki Sangyo Co., Ltd.	AC-PD-WPS-11ac-P	v2.0.03P and earlier

References

Timeline

Published: Apr 9, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-250546.1Movable Type contains a reflected cross-site scripting vulnerability in the user information edit page. When Multi-Factor authentication plu CVE-2025-250555.3Authentication bypass by spoofing issue exists in FileMegane versions above 1.0.0.0 prior to 3.4.0.0, which may lead to user impersonation. CVE-2025-250564.3Cross-site request forgery vulnerability exists in Wi-Fi AP UNIT 'AC-WPS-11ac series'. If a user views a malicious page while logged in, uni CVE-2025-250575.5in OpenHarmony v5.0.2 and prior versions allow a local attacker case DOS through missing release of memory.CVE-2025-250583.3Improper initialization for some ESXi kernel mode driver for the Intel(R) Ethernet 800-Series before version 2.2.2.0 (esxi 8.0) & 2.2.3.CVE-2025-250596.7Uncontrolled search path for some Intel(R) One Boot Flash Update (Intel(R) OFU) software before version 14.1.31 within Ring 3: User Applicat CVE-2025-25065.3When pglogical attempts to replicate data, it does not verify it is using a replication connection, which means a user with CONNECT access t CVE-2025-250608.2Missing authentication for critical function vulnerability exists in AssetView and AssetView CLOUD. If exploited, the files on the server wh CVE-2025-250615.8Unintended proxy or intermediary ('Confused Deputy') issue exists in HMI ViewJet C-more series and HMI GC-A2 series, which may allow a remot CVE-2025-250624.4An XSS issue was discovered in Backdrop CMS 1.28.x before 1.28.5 and 1.29.x before 1.29.3. It doesn't sufficiently isolate long text content CVE-2025-250634.4An XSS issue was discovered in Backdrop CMS 1.28.x before 1.28.5 and 1.29.x before 1.29.3. It does not sufficiently validate uploaded SVG im CVE-2025-250648.8SQL injection vulnerability in the ZimbraSync Service SOAP endpoint in Zimbra Collaboration 10.0.x before 10.0.12 and 10.1.x before 10.1.4 d