CVE-2025-11837

This vulnerability lets someone on the network turn the software into a tool for running their own malicious commands. In real attacks, malware is being installed on infected routers to act like a network “helper,” scanning other systems and relaying traffic for the attacker. If your business runs an affected Malware Remover version, it can be used to take over the device and cause further harm.

This matters if you run Malware Remover and your version is prior to 6.6.8.20251023. Attackers do not need to log in or trick a user to start the attack, because it’s remotely reachable over the network. Due to confirmed in-the-wild exploitation, treat it as a real risk when your Malware Remover system is exposed to attackers over the network and reachable from untrusted hosts.

This is RED because attackers are already exploiting CVE-2025-11837 in the wild. The reported campaign (AryStinger) is using compromised routers to scan and proxy traffic, which increases the chance of quick, cascading compromise. You should upgrade to the fixed version without delay if you’re running any vulnerable Malware Remover release.