openmptcprouter up to 0.64 sysupgrade.c create_xor_ipad_opad os command injection

Summaryinfo

A vulnerability was found in openmptcprouter up to 0.64. It has been declared as problematic. This affects the function create_xor_ipad_opad of the file common/package/utils/sys-upgrade-helper/src/tools/sysupgrade.c. Executing a manipulation can lead to an unknown weakness. This vulnerability is registered as CVE-2025-65882. No exploit is available. A patch should be applied to remediate this issue.

Detailsinfo

A vulnerability classified as problematic was found in openmptcprouter up to 0.64. This vulnerability affects the function create_xor_ipad_opad of the file common/package/utils/sys-upgrade-helper/src/tools/sysupgrade.c. The CWE definition for the vulnerability is CWE-78. The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

An issue was discovered in openmptcprouter thru 0.64 in file common/package/utils/sys-upgrade-helper/src/tools/sysupgrade.c in function create_xor_ipad_opad allowing attackers to potentially write arbitrary files or execute arbitrary commands.

This vulnerability was named CVE-2025-65882 since 11/18/2025. Technical details are known, but there is no available exploit. This vulnerability is assigned to T1202 by the MITRE ATT&CK project.

Applying the patch 09393d1c41a227bea7d5b85c0a06221b1302b25f is able to eliminate this problem. The bugfix is ready for download at github.com.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Router Operating System

Name

• openmptcprouter

Version

• 0.1
• 0.2
• 0.3
• 0.4
• 0.5
• 0.6
• 0.7
• 0.8
• 0.9
• 0.10
• 0.11
• 0.12
• 0.13
• 0.14
• 0.15
• 0.16
• 0.17
• 0.18
• 0.19
• 0.20
• 0.21
• 0.22
• 0.23
• 0.24
• 0.25
• 0.26
• 0.27
• 0.28
• 0.29
• 0.30
• 0.31
• 0.32
• 0.33
• 0.34
• 0.35
• 0.36
• 0.37
• 0.38
• 0.39
• 0.40
• 0.41
• 0.42
• 0.43
• 0.44
• 0.45
• 0.46
• 0.47
• 0.48
• 0.49
• 0.50
• 0.51
• 0.52
• 0.53
• 0.54
• 0.55
• 0.56
• 0.57
• 0.58
• 0.59
• 0.60
• 0.61
• 0.62
• 0.63
• 0.64

License

• open-source

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion