CVE-2025-34115
Raw vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2025-34115 is a high-severity Improper Input Validation (CWE-20) vulnerability in Githubusercontent (inferred from references). Its CVSS base score is 8.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Command and Scripting Interpreter (T1059); ranked in the top 18% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to AC-14 (Permitted Actions Without Identification or Authentication) and IA-2 (Identification and Authentication (Organizational Users)) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
An authenticated command injection vulnerability exists in OP5 Monitor through version 7.1.9 in the configuration section of the web interface. The flaw is triggered via the cmd_str parameter passed to the command_test.php endpoint, allowing a logged-in user to abuse the "Test this command" feature. It is tracked under CWE-20, CWE-78, and CWE-306, carries a CVSS 4.0 score of 8.7, and was corrected in release 7.2.0.
An attacker who possesses valid credentials and access to the command-testing functionality can supply crafted input that results in arbitrary shell command execution on the server as the unprivileged web-application user. The attack is network-reachable, requires no user interaction beyond authentication, and grants the attacker the ability to read, modify, or delete data accessible to that account.
Public exploit code, including a Metasploit module and an Exploit-DB entry, has been available for the issue, and the vendor advisory from ITRS Group along with the VulnCheck entry confirm the patch in 7.2.0 as the primary mitigation. The associated EPSS score has remained steady at 0.7072.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-21432
Vulnerability Data
An authenticated command injection vulnerability exists in OP5 Monitor through version 7.1.9 via the 'cmd_str' parameter in the command_test.php endpoint. A user with access to the web interface can exploit the 'Test this command' feature to execute arbitrary shell commands…
more
as the unprivileged web application user. The vulnerability resides in the configuration section of the application and requires valid login credentials with access to the command testing functionality. This issue is fixed in version 7.2.0.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 12 hardening rules · 3 OS baselines
V6.2.3V6.4.4V10.4.16V12.1.3
Mitigating Controls (NIST 800-53 r5) AI
Directly mandates unique identification and authentication of users before access to functions requiring identity.
Extends the same authentication requirement to non-organizational users accessing critical functionality.
Requires authentication of services before they can invoke or expose critical functions.
Explicitly identifies and limits actions permitted without authentication, preventing critical functions from being exposed.
Developer testing and evaluation can discover missing input validation through analysis or test cases.
SI-10 directly requires validity checks on information inputs, structurally preventing improper or missing validation.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Directly requires authentication of users/services/hardware, which eliminates missing authentication for critical functions.
Secure SDLC practices directly require and enforce input validation during development.
Managing identities and credentials is a prerequisite for authentication but does not itself enforce it on critical functions.
Defining and enforcing authorizations assumes prior authentication and therefore only partially mitigates the absence of authentication.
Protecting networks from unauthorized access can be undermined by missing authentication but does not address the root authentication gap.
Routine patching/maintenance can remediate known command-injection CVEs in dependencies (partial forward) but does nothing to stop developers from introducing improper neutralization in custom code (none reverse).
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
The control explicitly calls for authentication before any critical function is reached, eliminating the possibility of bypassing authentication for high-value operations.
Testing against a defined set of requirements and using code review plus vulnerability scanning forces validation of inputs and handling of unanticipated conditions, reducing the chance that malformed data will be accepted.
Mandating authentication requirements for critical functions at the requirements-gathering stage ensures that essential operations are not left unprotected by missing login or verification mechanisms.
Mandating authentication for network services and critical functions stops attackers from invoking sensitive operations without credentials, closing gaps where authentication is absent for important capabilities.
Secure-coding guidelines and mandatory security testing (including code scans) compel developers to validate and sanitize inputs at design and implementation time, lowering the incidence of malformed or malicious data reaching downstream components.
Mandating input controls that include integrity checks and input validation ensures that untrusted data is examined before use, blocking the root cause of many injection and malformed-data weaknesses.
Hardening callouts derived
Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (authoritative rows only; rows rated `none` are excluded).
Oracle Linux 8 (2 rules)
- V-248585 OL 8 must require reauthentication when using the "sudo" command. prevents CWE-306
- V-248827 OL 8 must not have the rsh-server package installed. prevents CWE-306
RHEL 7 (2 rules)
- V-204442 The Red Hat Enterprise Linux operating system must not have the rsh-server package installed. prevents CWE-306
- V-237635 The Red Hat Enterprise Linux operating system must require re-authentication when using the "sudo" command. prevents CWE-306
RHEL 8 (3 rules)
- V-230492 RHEL 8 must not have the rsh-server package installed. prevents CWE-306
- V-230265 RHEL 8 must prevent the installation of software, patches, service packs, device drivers, or operating system components of local packages without verification they have been digitally signed using a certificate that is issued by a Certificate Authority (CA) that is recognized and approved by the organization. prevents CWE-20
- V-237643 RHEL 8 must require re-authentication when using the "sudo" command. prevents CWE-306