CVE-2025-34116highCWE-20CWE-306CWE-78

CVE-2025-34116: falha de alta gravidade em IPFire

IPFire < 2.19 Core Update 101 proxy.cgi RCE

Publicada em · Atualizada em

36Vexday Risk Score

Corrija em breve. Ela tem exploit funcional público.

ssvc Attendcvss 8.7epss 1.9%
da publicação à arma0 dias
Publicada no NVD15 de jul.
metasploit4 de mai.
probabilidade de exploração
1.9%top 20% das CVEs
exploração observada
nãonenhuma fonte reporta
A remote command execution vulnerability exists in IPFire before version 2.19 Core Update 101 via the 'proxy.cgi' CGI interface. An authenticated attacker can inject arbitrary shell commands through crafted values in the NCSA user creation form fields, leading to command execution with web server privileges.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
IPFire Project · IPFire
CVEs relacionadas — IPFire

No mesmo produto, das mais perigosas para as menos.

CVE-2022-36368MEDIUMCVE-2022-36368EPSS 0.8%
Referências
https://bugzilla.ipfire.org/show_bug.cgi?id=11087https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/http/ipfire_proxy_exec.rbhttps://www.asafety.fr/en/vuln-exploit-poc/xss-rce-ipfire-2-19-core-update-101-remote-command-execution/https://www.exploit-db.com/exploits/39765https://www.ipfire.org/news/ipfire-2-19-core-update-101-releasedhttps://www.vulncheck.com/advisories/ipfire-authenticated-rce