CVE-2025-34069
Published: 02 July 2025
Summary
CVE-2025-34069 is a critical-severity Missing Authentication for Critical Function (CWE-306) vulnerability in Gfi Kerio Control. Its CVSS base score is 9.5 (Critical).
Operationally, ranked in the top 18.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
CVE-2025-34069 is an authentication bypass vulnerability in GFI Kerio Control 9.4.5 stemming from an insecure default proxy configuration and weak access controls in the GFIAgent service. The non-transparent proxy listening on TCP port 3128 accepts unauthenticated requests and forwards them to internal management endpoints on ports 7995 and 7996, allowing attackers to retrieve the appliance UUID and issue administrative commands without passing through normal firewall rules. The flaw is tracked under CWE-306 and carries a CVSS 4.0 score of 9.5.
An unauthenticated remote attacker can exploit the proxy to reach the GFIAgent service directly, obtain full administrative control over the Kerio Control appliance, and perform arbitrary management operations. The attack requires no credentials or user interaction and succeeds against internet-exposed instances that retain the default proxy settings.
Public advisories from SSD Disclosure and VulnCheck document the issue and provide technical details for defenders. The EPSS score remains flat at 0.0146 with no observed rise after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-19722
Vulnerability details
An authentication bypass vulnerability exists in GFI Kerio Control 9.4.5 due to insecure default proxy configuration and weak access control in the GFIAgent service. The non-transparent proxy on TCP port 3128 can be used to forward unauthenticated requests to internal…
more
services such as GFIAgent, bypassing firewall restrictions and exposing internal management endpoints. This enables unauthenticated attackers to access the GFIAgent service on ports 7995 and 7996, retrieve the appliance UUID, and issue administrative requests via the proxy. Exploitation results in full administrative access to the Kerio Control appliance.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Requires established identification and authentication to unlock, mitigating missing authentication for continued system access.
Requiring identification and rationale for actions allowed without authentication ensures critical functions are not left unprotected by forcing review of authentication requirements.
Authorizing mobile device connections to organizational systems ensures authentication is performed for this critical access function.
Guarantees critical functions are protected by mandatory invocation of the access control mechanism.
Auditing sessions makes it possible to detect access to critical functions without required authentication.
The assessment process confirms authentication is present and effective for critical functions, preventing exploitation from missing authentication.
Certification assesses that critical functions have required authentication controls in place.
Disabling non-essential functions and services eliminates the need to secure them, reducing exposure from missing authentication on unnecessary components.