Opto 22 groov View

Summary

Vulnerabilities 1

• High 7.6
  CVE-2025-13084

  Opto 22 groov View Exposure of Sensitive Information Through Metadata

  The users endpoint in the groov View API returns a list of all users and associated metadata including their API keys. This endpoint requires an Editor role to access and will display API keys for all users, including Administrators.

  Opto 22 GRV-EPIC-PR1 Firmware groov View Server GRV-EPIC-PR2 Firmware
  Nov 26, 2025

Revision history

1. 2025-11-25 #1

   Initial Publication

References

• ICSA Advisory ICSA-25-329-04 - Web Version
  https://www.cisa.gov/news-events/ics-advisories/icsa-25-329-04
• Recommended Practices
  https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
• Recommended Practices
  https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
• Recommended Practices
  https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
• Recommended Practices
  https://www.cisa.gov/topics/industrial-control-systems
• Recommended Practices
  https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01
• Recommended Practices
  https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
• Recommended Practices
  https://www.cisa.gov/news-events/news/targeted-cyber-intrusion-detection-and-mitigation-strategies-update-b
• Recommended Practices
  https://www.cisa.gov/secure-our-world/teach-employees-avoid-phishing
• Recommended Practices
  https://www.cisa.gov/news-events/news/avoiding-social-engineering-and-phishing-attacks