CVE-2025-30911 describes a critical command injection vulnerability in Rometheme RTMKit versions up to 1.5.4. This improper control of code generation flaw allows an attacker with network access and low privileges to execute arbitrary commands without user interaction. The vulnerability affects the RTMKit product by Rometheme and has a CVSS 3.1 base score of 9.9, indicating severe impact on confidentiality, integrity, and availability. No patch or mitigation details are currently available from the vendor or advisory sources.

Successful exploitation of this vulnerability could lead to full system compromise, including unauthorized command execution with potentially severe consequences on confidentiality, integrity, and availability of affected systems. Given the CVSS score of 9.9, the impact is critical. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict network access to the affected RTMKit instances and monitor for suspicious activity related to command execution attempts. Avoid exposing the vulnerable versions to untrusted networks.