Cyber Resilience

CVE-2025-34082

CriticalPublic PoCRCE

Published: 03 July 2025

Published
03 July 2025
Modified
15 April 2026
KEV Added
—
Patch
—
CVSS Score v4 9.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.6714 98.6th percentile
Risk Priority 59 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-34082 is a critical-severity OS Command Injection (CWE-78) vulnerability in Igel OS (inferred from references). Its CVSS base score is 9.3 (Critical).

Operationally, ranked in the top 1.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Deeper analysis

A command injection vulnerability exists in IGEL OS versions prior to 11.04.270 within the Secure Terminal and Secure Shadow services. The flaw stems from improper input sanitization when processing specially crafted PROXYCMD commands received on TCP ports 30022 and 5900, and is tracked under CWE-78. IGEL OS 10.x has reached end-of-life status, leaving those deployments without vendor support.

An unauthenticated attacker with network access to a vulnerable device can supply malicious PROXYCMD input to execute arbitrary commands, resulting in remote code execution with elevated privileges. The vulnerability carries a CVSS 4.0 score of 9.3, reflecting network-accessible attack complexity that requires no authentication or user interaction.

Public references include an IGEL security advisory and release notes for version 11.04.270 that address the issue, along with a Metasploit module implementing the exploit. The associated EPSS score stands at 0.6714 with no material rise from a lower baseline.

EU & UK References

Vulnerability details

A command injection vulnerability exists in IGEL OS versions prior to 11.04.270 within the Secure Terminal and Secure Shadow services. The flaw arises due to improper input sanitization in the handling of specially crafted PROXYCMD commands on TCP ports 30022…

more

and 5900. An unauthenticated attacker with network access to a vulnerable device can inject arbitrary commands, leading to remote code execution with elevated privileges. NOTE: IGEL OS v10.x has reached end-of-life (EOL) status.

CWE(s)
CWE-78

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

Igel
OS
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

SC-27 Platform-independent Applications
addresses: CWE-78

Platform-independent apps typically execute inside a managed runtime or sandbox that restricts direct OS command execution, reducing the ability to exploit OS command injection.

SI-10 Information Input Validation
addresses: CWE-78

Validates inputs to block special elements that would alter OS command execution.

References