CVEvulnerability

CVE-2025-34116

8.7 HIGH Published 2025-07-15 Modified 2026-06-17 Official page ↗

Status: Deferred
Published: 2025-07-15
Last modified: 2026-06-17
Assigner: [email protected]
CVSS 4.0 ([email protected]): 8.7 HIGH — CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weaknesses: CWE-20, CWE-306, CWE-78

Description

A remote command execution vulnerability exists in IPFire before version 2.19 Core Update 101 via the 'proxy.cgi' CGI interface. An authenticated attacker can inject arbitrary shell commands through crafted values in the NCSA user creation form fields, leading to command execution with web server privileges.

Weakness · CWE (3)

CWE-20 Improper Input Validation weakness
CWE-306 Missing Authentication for Critical Functionality weakness
CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References

https://bugzilla.ipfire.org/show_bug.cgi?id=11087 bugzilla.ipfire.org
https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/http/ipfire_proxy_exec.rb raw.githubusercontent.com
https://www.asafety.fr/en/vuln-exploit-poc/xss-rce-ipfire-2-19-core-update-101-remote-command-execution/ www.asafety.fr
https://www.exploit-db.com/exploits/39765 www.exploit-db.com
https://www.ipfire.org/news/ipfire-2-19-core-update-101-released www.ipfire.org
https://www.vulncheck.com/advisories/ipfire-authenticated-rce www.vulncheck.com

CVE-2025-34116

Description

Related

Weakness · CWE (3)

References