CVE-2025-59370

HighCVSS 7.5/10Last modified Oct 18, 2026

Description

A command injection vulnerability has been identified in bwdpi. A remote, authenticated attacker could leverage this vulnerability to potentially execute arbitrary commands, leading to the device executing unintended instructions. Refer to the 'Security Update for ASUS Router Firmware' section on the ASUS Security Advisory for more information.

Metrics

CVSS 4.0 7.5/10

CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published: Nov 25, 2025
Last modified: Oct 18, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-593717.5An authentication bypass vulnerability has been identified in the IFTTT integration feature. A remote, authenticated attacker could leverage CVE-2025-593726.9A path traversal vulnerability has been identified in certain router models. A remote, authenticated attacker could exploit this vulnerabili CVE-2025-593738.5A local privilege escalation vulnerability exists in the restore mechanism of ASUS System Control Interface. It can be triggered when a CVE-2025-593749.8"UNSUPPORTED WHEN ASSIGNED" Certain versions of the ASUS Live Update client were distributed with unauthorized modifications introduced thro CVE-2025-593757.5libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsi CVE-2025-593765.3feiskyer mcp-kubernetes-server through 0.1.11 does not consider chained commands in the implementation of --disable-write and --disable-dele CVE-2025-593779.8feiskyer mcp-kubernetes-server through 0.1.11 allows OS command injection, even in read-only mode, via /mcp/kubectl because shell=True is us CVE-2025-593785.7In guix-daemon in GNU Guix before 1618ca7, a content-addressed-mirrors file can be written to create a setuid program that allows a regular CVE-2025-593797.5DwyerOmega Isensix Advanced Remote Monitoring System (ARMS) 1.5.7 allows an attacker to retrieve sensitive information from the underlying S CVE-2025-59384.3The Digital Marketing and Agency Templates Addons for Elementor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all vers CVE-2025-593804.9A path traversal vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrat CVE-2025-593814.9A path traversal vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrat