CVE-2025-22906 identifies a command injection vulnerability in RE11S v1.11. The issue arises from improper input handling of the L2TPUserName parameter at the /goform/setWAN endpoint, enabling remote attackers to execute arbitrary commands without authentication. The vulnerability has a CVSS 3.1 base score of 9.8, reflecting its critical severity and potential for full system compromise. No vendor advisory or patch information is available at this time, and no known exploits have been reported in the wild.

Successful exploitation can lead to full compromise of the affected system, including unauthorized command execution, complete loss of confidentiality, integrity, and availability. Given the unauthenticated nature of the vulnerability, attackers can remotely execute arbitrary commands without prior access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected endpoint and monitor for suspicious activity related to the /goform/setWAN interface. Avoid exposing the vulnerable service to untrusted networks.