CVEvulnerability

CVE-2025-34115

8.7 HIGH Published 2025-07-15 Modified 2026-09-08 Official page ↗
Status
Deferred
Published
2025-07-15
Last modified
2026-09-08
Assigner
[email protected]
CVSS 4.0 ([email protected])
8.7 HIGH — CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weaknesses
CWE-20, CWE-306, CWE-78

Description

An authenticated command injection vulnerability exists in OP5 Monitor through version 7.1.9 via the 'cmd_str' parameter in the command_test.php endpoint. A user with access to the web interface can exploit the 'Test this command' feature to execute arbitrary shell commands as the unprivileged web application user. The vulnerability resides in the configuration section of the application and requires valid login credentials with access to the command testing functionality. This issue is fixed in version 7.2.0.

Related

Weakness · CWE (3)

  • CWE-20 Improper Input Validation weakness
  • CWE-306 Missing Authentication for Critical Functionality weakness
  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References