{"id":"CVE-2025-8748","aliases":["EUVD-2025-23984","GHSA-q792-xxc2-jx5c"],"status":"published","title":"OS command injection in MiR robots and MiR fleet via crafted HTTP requests","description":"MiR software versions prior to version 3.0.0 are affected by a command injection vulnerability. A malicious \nHTTP request crafted by an authenticated user could allow the execution of arbitrary commands on the \nunderlying operating system.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.01314,"percentile":0.70978,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-78"],"published":"2025-08-08T11:09:17Z","modified":"2026-06-17T10:07:33Z","products":[{"vendor":"mobile industrial robots","product":"mir fleet"},{"vendor":"mobile industrial robots","product":"mir robots"}],"references":[{"url":"https://mobile-industrial-robots.com/security-advisories/command-injection","tags":["vendor-advisory"]},{"url":"https://supportportal.mobile-industrial-robots.com/documentation/mir-cybersecurity-guide/mir-cybersecurity-guide/"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-8748"},{"url":"https://a.storyblok.com/f/230581/x/16eefc00b8/msa-16.pdf"},{"url":"https://supportportal.mobile-industrial-robots.com/documentation/mir-cybersecurity-guide/mir-cybersecurity-guide"},{"url":"https://github.com/advisories/GHSA-q792-xxc2-jx5c"}],"sources":{"cve":[{"id":"CVE-2025-8748","title":"OS command injection in MiR robots and MiR fleet via crafted HTTP requests","description":"MiR software versions prior to version 3.0.0 are affected by a command injection vulnerability. A malicious \nHTTP request crafted by an authenticated user could allow the execution of arbitrary commands on the \nunderlying operating system.","status":"published","published":"2025-08-08T11:09:17.348Z","modified":"2025-11-05T12:02:30.747Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:32:38.025852Z"}],"euvd":[{"id":"EUVD-2025-23984","description":"MiR software versions prior to version 3.0.0 are affected by a command injection vulnerability. A malicious \nHTTP request crafted by an authenticated user could allow the execution of arbitrary commands on the \nunderlying operating system.","status":"published","published":"2025-08-08T11:09:17Z","modified":"2025-11-05T12:02:30Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T19:49:20.323605Z"}],"ghsa":[{"id":"GHSA-q792-xxc2-jx5c","title":"MiR software versions prior to version 3.0.0 are affected by a command injection vulnerability. A...","description":"MiR software versions prior to version 3.0.0 are affected by a command injection vulnerability. A malicious \nHTTP request crafted by an authenticated user could allow the execution of arbitrary commands on the \nunderlying operating system.","status":"published","published":"2025-08-08T12:32:17Z","modified":"2025-11-05T15:32:08Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T15:04:40.062939Z"}],"nvd":[{"id":"CVE-2025-8748","description":"MiR software versions prior to version 3.0.0 are affected by a command injection vulnerability. A malicious \nHTTP request crafted by an authenticated user could allow the execution of arbitrary commands on the \nunderlying operating system.","status":"published","published":"2025-08-08T11:15:29.243Z","modified":"2026-06-17T10:07:33.027Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:11:22.319351Z"}]}}