All CISA Advisories, EN

Opto 22 groov View

View CSAF

1. EXECUTIVE SUMMARY

  • CVSS v4 6.1
  • ATTENTION: Exploitable remotely/Low attack complexity
  • Vendor: Opto 22
  • Equipment: groov View
  • Vulnerability: Exposure of Sensitive Information Through Metadata

2. RISK EVALUATION

Successful exploitation of this vulnerability could result in credential exposure, key exposure, and privilege escalation.

3. TECHNICAL DETAILS

3.1 AFFECTED PRODUCTS

The following versions of groov View are affected:

  • groov View Server for Windows: Versions R1.0a to R4.5d
  • GRV-EPIC-PR1 Firmware: Versions prior to 4.0.3
  • GRV-EPIC-PR2 Firmware: Versions prior to 4.0.3

3.2 VULNERABILITY OVERVIEW

3.2.1 Exposure of Sensitive Information Through Metadata CWE-1230

The users endpoint in the groov View API returns a list of all users and associated metadata including their API keys. This endpoint requires an Editor role to access and will display API keys for all users, including Administrators.

CVE-2025-13084 has been assigned to this vulnerability. A CVSS v3.1 base score of 7.6 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L).

A CVSS v4 score has also been calculated for CVE-2025-13084. A base score of 6.1 has been calculated; the CVSS vector string is (AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N).

3.3 BACKGROUND