CVE-2025-65882 is a command injection vulnerability in openmptcprouter through version 0.64. The issue resides in the create_xor_ipad_opad function in sysupgrade.c, which is part of the sys-upgrade-helper tool. Exploitation could allow remote attackers to write arbitrary files or execute arbitrary commands without authentication. The vulnerability is classified under CWE-78 (Improper Neutralization of Special Elements used in an OS Command). No official patch or vendor advisory is currently provided, and no known exploits are reported in the wild.

Successful exploitation of this vulnerability can lead to full system compromise, including arbitrary file writes and command execution. This impacts confidentiality, integrity, and availability of the affected system, potentially allowing attackers to take complete control remotely without any privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix is currently available, users should monitor the vendor's communications for updates. Until a fix is released, consider restricting network access to the affected service and applying any available workarounds recommended by the vendor once published.