Cyber Resilience

CVE-2025-34115

HighPublic PoCRCE

Published: 15 July 2025

Published
15 July 2025
Modified
15 April 2026
KEV Added
Patch
CVSS Score v4 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.7072 98.7th percentile
Risk Priority 60 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-34115 is a high-severity Improper Input Validation (CWE-20) vulnerability in Githubusercontent (inferred from references). Its CVSS base score is 8.7 (High).

Operationally, ranked in the top 1.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Deeper analysis

An authenticated command injection vulnerability exists in OP5 Monitor through version 7.1.9 in the configuration section of the web interface. The flaw is triggered via the cmd_str parameter passed to the command_test.php endpoint, allowing a logged-in user to abuse the "Test this command" feature. It is tracked under CWE-20, CWE-78, and CWE-306, carries a CVSS 4.0 score of 8.7, and was corrected in release 7.2.0.

An attacker who possesses valid credentials and access to the command-testing functionality can supply crafted input that results in arbitrary shell command execution on the server as the unprivileged web-application user. The attack is network-reachable, requires no user interaction beyond authentication, and grants the attacker the ability to read, modify, or delete data accessible to that account.

Public exploit code, including a Metasploit module and an Exploit-DB entry, has been available for the issue, and the vendor advisory from ITRS Group along with the VulnCheck entry confirm the patch in 7.2.0 as the primary mitigation. The associated EPSS score has remained steady at 0.7072.

EU & UK References

Vulnerability details

An authenticated command injection vulnerability exists in OP5 Monitor through version 7.1.9 via the 'cmd_str' parameter in the command_test.php endpoint. A user with access to the web interface can exploit the 'Test this command' feature to execute arbitrary shell commands…

more

as the unprivileged web application user. The vulnerability resides in the configuration section of the application and requires valid login credentials with access to the command testing functionality. This issue is fixed in version 7.2.0.

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

Githubusercontent
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-20 CWE-78

Directly implements checks on information inputs to reject invalid data before processing.

addresses: CWE-306

Requires established identification and authentication to unlock, mitigating missing authentication for continued system access.

addresses: CWE-306

Requiring identification and rationale for actions allowed without authentication ensures critical functions are not left unprotected by forcing review of authentication requirements.

addresses: CWE-306

Authorizing mobile device connections to organizational systems ensures authentication is performed for this critical access function.

addresses: CWE-306

Guarantees critical functions are protected by mandatory invocation of the access control mechanism.

addresses: CWE-306

Auditing sessions makes it possible to detect access to critical functions without required authentication.

addresses: CWE-306

The assessment process confirms authentication is present and effective for critical functions, preventing exploitation from missing authentication.

addresses: CWE-306

Certification assesses that critical functions have required authentication controls in place.

References