CVE Intelligence

Opto22 vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Opto22 products: 2 record(s), with severity, exploitation and fixes.

GRV-EPIC-PR1 1GRV-EPIC-PR2 1groov RIO GRV-R7-MM1001-10 1groov RIO GRV-R7-MM2001-10 1groov RIO GRV-R7-I1VAPM-3 1groov View Server 1GRV-EPIC-PR1 Firmware 1GRV-EPIC-PR2 Firmware 1

Exploited only (KEV) →

CVE-2025-13084 High · 7.6 CWE-1230 Nov 26, 2025
Opto 22 groov View Exposure of Sensitive Information Through Metadata
The users endpoint in the groov View API returns a list of all users and associated metadata including their API keys. This endpoint requires an Editor role to access and will display API keys for all users, including Administrators.
CVE-2025-13087 Medium · 6.2 CWE-78 Nov 20, 2025
Command Injection in Opto22 Groov REST API
A vulnerability exists in the Opto22 Groov Manage REST API on GRV-EPIC and groov RIO Products that allows remote code execution with root privileges. When a POST request is executed against the vulnerable endpoint, the application reads certain header details and unsafely uses these values to build commands, allowing an attacker with administrative privileges to inject arbitrary commands that execute as root.