CVE-2025-63213

The QVidium Opera11 device (firmware version 2.9.0-Ax4x-opera11) is vulnerable to Remote Code Execution (RCE) due to improper input validation on the /cgi-bin/net_ping.cgi endpoint. An attacker can exploit this vulnerability by sending a specially crafted GET request with a malicious parameter to inject arbitrary commands. These commands are executed with root privileges, allowing attackers to gain full control over the device. This poses a significant security risk to any device running this software.

• CWE-20

• https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-63213_QVidium%20Opera11%20RCEExploit, Third Party Advisory
• https://qvidium.tv/Product
• https://undercodetesting.com/zero-day-vulnerabilities-discovered-in-qvidium-opera11-remote-code-execution-rce-exploit/Exploit, Third Party Advisory
• https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-63213_QVidium%20Opera11%20RCEExploit, Third Party Advisory

Published

Nov 19, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-63208An issue was discovered in bridgetech VB288 Objective QoE Co…7.5
• CVE-2025-63209The ELCA Star Transmitter Remote Control firmware 1.25 for S…7.5
• CVE-2025-6321A vulnerability has been found in PHPGurukul Pre-School Enro…8.8
• CVE-2025-63210The Newtec Celox UHD (models: CELOXA504, CELOXA820) running …9.8
• CVE-2025-63211Stored cross-site scripting vulnerability in bridgetech VBC …6.1
• CVE-2025-63212GatesAir Flexiva-LX devices on firmware 1.0.13 and 2.0, incl…6.5
• CVE-2025-63214An issue was discovered in bridgetech VBC Server & Element M…6.5
• CVE-2025-63215The Sound4 IMPACT web-based management interface is vulnerab…7.2
• CVE-2025-63216The Itel DAB Gateway (IDGat build c041640a) is vulnerable to…10
• CVE-2025-63217The Itel DAB MUX (IDMUX build c041640a) is vulnerable to Aut…9.8
• CVE-2025-63218The Axel Technology WOLF1MS and WOLF2MS devices (firmware ve…9.8
• CVE-2025-63219The ITEL ISO FM SFN Adapter (firmware ISO2 2.0.0.0, WebServe…7.5