CVE-2025-34312: fallo de gravedad alta en IPFire.org IPFire
IPFire < v2.29 Command Injection via URL Filter Blacklist
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 8.7epss 2.2%
IPFire versions prior to 2.29 (Core Update 198) contain a command injection vulnerability that allows an authenticated attacker to execute arbitrary commands as the 'nobody' user via the BE_NAME parameter when installing a blacklist. When a blacklist is installed the application issues an HTTP POST to /cgi-bin/urlfilter.cgi and interpolates the value of BE_NAME directly into a shell invocation without appropriate sanitation. Crafted input can inject shell metacharacters, leading to arbitrary command execution in the context of the 'nobody' user.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Productos afectados
IPFire.org · IPFireCVEs relacionadas — IPFire.org IPFire
En el mismo producto, de las más peligrosas a las menos.
CVE-2025-34311HIGHIPFire < v2.29 Command Injection via Proxy Report CreationEPSS 13.5%CVE-2025-34309MEDIUMIPFire < v2.29 Stored XSS via Dynamic DNS HostEPSS 5.3%CVE-2025-34301MEDIUMIPFire < v2.29 Stored XSS via Location Group CreationEPSS 5.3%CVE-2025-34318MEDIUMIPFire < v2.29 Stored XSS via DNS Creation (proxy.cgi)EPSS 0.5%CVE-2025-34307MEDIUMIPFire < v2.29 Stored XSS via Default Country SearchEPSS 0.5%CVE-2025-34306MEDIUMIPFire < v2.29 Stored XSS via Default IP Search ValueEPSS 0.5%