Skip to main content

CISA issues advisory on Opto 22 GRV-EPIC and groov RIO vulnerabilities

Source Decision Insights Threat Desk Published November 27, 2025 Companies 1
Human View Machine View

343rd article in the last 90 days, one of 453 articles referencing Cybersecurity and Infrastructure Security Agency (CISA). Previous coverage: CISA issues alert on Festo Didactic products TIA-Portal vulnerability (Nov 2025).

Companies mentioned

Best suited for

Persona
Security Operations Leader
Decision stage
Which to buy
Adoption curve
Early Majority
Industry
Industrials / Capital Goods / Industrial Conglomerates / Industrials & Manufacturing

Our classification, not the publisher's statement. Best suited for, not only for.

Several models of Opto 22's GRV-EPIC and groov RIO programmable logic controllers exhibit a vulnerability that enables remote execution of Operating System (OS) commands with root-level privileges.

Specifically, this security flaw, identified as CVE-2025-13087, affects GRV-EPIC-PR1 and GRV-EPIC-PR2 firmware versions earlier than 4.0.3, as well as groov RIO firmware versions prior to 4.0.3 across multiple models including GRV-R7-MM1001-10, GRV-R7-MM2001-10, and GRV-R7-I1VAPM-3. The vulnerability exists in the Representational State Transfer (REST) Application Programming Interface (API) component of Groov Manage, where a POST request to a particular endpoint processes header data unsafely to construct commands, permitting an attacker with administrative access to execute arbitrary shell commands as root. This issue is categorized under CWE-78, Improper Neutralization of Special Elements used in an OS Command. Common Vulnerability Scoring System (CVSS) v3.1 rates this vulnerability at 6.2 with vector Antivirus Software (AV):N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:L, while CVSS v4 assigns a score of 7.5 with vector AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N.

Successful exploitation allows arbitrary shell commands to run with root privileges, presenting a risk of unauthorized control of affected systems.

Opto 22 provides a firmware update addressing this vulnerability, recommending users to upgrade affected devices to version 4.0.3. Documentation detailing the patch is available from the vendor.

Security guidance includes minimizing exposure of control system devices to external networks and internet access, isolating control systems behind firewalls, and employing secure remote access methods like updated Virtual Private Networks. CISA advises organizations to conduct thorough impact analysis and risk assessment before applying defensive measures and references several resources on control systems security practices. Reports of exploitation targeting this vulnerability have not been documented, and the attack complexity is rated high.

Blog post, originally published by CISA at cisa.gov.

Mentions

Structured data (JSON-LD)

The schema.org markup this page publishes for search engines and AI agents, exactly as they read it.

[
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/#website",
    "@type": "WebSite",
    "name": "Decision Insights",
    "potentialAction": {
      "@type": "SearchAction",
      "target": {
        "@type": "EntryPoint",
        "urlTemplate": "https://decisioninsights.ai/search/?q={search_term_string}&submit=1"
      }
    },
    "publisher": {
      "@id": "https://decisioninsights.ai/#organization"
    },
    "url": "https://decisioninsights.ai"
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/#organization",
    "@type": "Organization",
    "contactPoint": {
      "@type": "ContactPoint",
      "contactType": "customer support",
      "email": "[email protected]"
    },
    "description": "Decision Insights is a Registry of technology companies, open source projects, and industry terms, built for people and for AI agents that need sourced, structured information.",
    "logo": {
      "@type": "ImageObject",
      "url": "https://wiretap-cdn-assets.nyc3.cdn.digitaloceanspaces.com/decision-insights/[email protected]"
    },
    "name": "Decision Insights",
    "parentOrganization": {
      "@type": "Organization",
      "name": "Wiretap Labs",
      "sameAs": [
        "https://www.linkedin.com/company/wiretap-labs",
        "https://www.crunchbase.com/organization/wiretap-labs"
      ],
      "url": "https://wiretaplabs.com"
    },
    "publishingPrinciples": "https://decisioninsights.ai/standards/",
    "sameAs": [
      "https://www.linkedin.com/company/decisioninsights"
    ],
    "url": "https://decisioninsights.ai"
  },
  {
    "@context": "https://schema.org",
    "@type": "BreadcrumbList",
    "itemListElement": [
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai",
        "name": "Decision Insights",
        "position": 1
      },
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai/records/",
        "name": "Records",
        "position": 2
      },
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai/cisa-issues-advisory-on-opto-22-grv-epic-and-groov-rio-vulnerabilities/",
        "name": "CISA issues advisory on Opto 22 GRV-EPIC and groov RIO vulnerabilities",
        "position": 3
      }
    ]
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/cisa-issues-advisory-on-opto-22-grv-epic-and-groov-rio-vulnerabilities/#blogposting",
    "@type": "BlogPosting",
    "about": {
      "@id": "https://decisioninsights.ai/registry/department-of-homeland-security/cybersecurity-and-infrastructure-security-agency-cisa/#organization",
      "@type": "Organization",
      "mainEntityOfPage": "https://decisioninsights.ai/registry/department-of-homeland-security/cybersecurity-and-infrastructure-security-agency-cisa/",
      "name": "Cybersecurity and Infrastructure Security Agency (CISA)"
    },
    "articleSection": [
      "Cybersecurity",
      "AI infrastructure"
    ],
    "audience": [
      {
        "@type": "Audience",
        "additionalType": "Persona",
        "audienceType": "Security Operations Leader"
      },
      {
        "@type": "Audience",
        "additionalType": "Adoption curve",
        "audienceType": "Early Majority"
      },
      {
        "@type": "Audience",
        "additionalType": "Industry",
        "audienceType": "Industrials / Capital Goods / Industrial Conglomerates / Industrials & Manufacturing"
      }
    ],
    "author": {
      "@id": "https://decisioninsights.ai/author/decision-insights-threat-desk/#person",
      "@type": "Person",
      "name": "Decision Insights Threat Desk",
      "url": "https://decisioninsights.ai/author/decision-insights-threat-desk/"
    },
    "dateModified": "2026-08-23T13:07:52-06:00",
    "datePublished": "2025-11-27T11:29:43-07:00",
    "description": "CISA reports a remote OS command injection vulnerability in Opto 22 GRV-EPIC and groov RIO firmware prior to version 4.0.3 with available patches.",
    "headline": "CISA issues advisory on Opto 22 GRV-EPIC and groov RIO vulnerabilities",
    "isBasedOn": {
      "@type": "CreativeWork",
      "author": {
        "@type": "Person",
        "name": "CISA"
      },
      "sourceOrganization": {
        "@id": "https://decisioninsights.ai/registry/department-of-homeland-security/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/department-of-homeland-security/",
        "name": "Department of Homeland Security"
      },
      "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-324-03"
    },
    "keywords": [
      "Antivirus Software",
      "Common Vulnerability Scoring System",
      "Firmware",
      "Operating System",
      "Representational State Transfer",
      "Vulnerabilities"
    ],
    "mainEntityOfPage": {
      "@id": "https://decisioninsights.ai/cisa-issues-advisory-on-opto-22-grv-epic-and-groov-rio-vulnerabilities/",
      "@type": "WebPage",
      "sdDatePublished": "2026-08-23",
      "sdPublisher": {
        "@id": "https://decisioninsights.ai/#organization"
      }
    },
    "mentions": [
      {
        "@id": "https://decisioninsights.ai/registry/department-of-homeland-security/cybersecurity-and-infrastructure-security-agency-cisa/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/department-of-homeland-security/cybersecurity-and-infrastructure-security-agency-cisa/",
        "name": "Cybersecurity and Infrastructure Security Agency (CISA)"
      }
    ],
    "publisher": {
      "@id": "https://decisioninsights.ai/#organization"
    }
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/author/decision-insights-threat-desk/#person",
    "@type": "Person",
    "description": "CISA advisories, vendor security bulletins, and CVE disclosures, summarized into sourced briefs. Produced under our Standards & Methodology.",
    "name": "Decision Insights Threat Desk",
    "sameAs": [
      "https://www.linkedin.com/showcase/decisioninsights/"
    ],
    "url": "https://decisioninsights.ai/author/decision-insights-threat-desk/"
  }
]

Is this your company? Get structured data for your own pages