CVE-2025-34115
Published: 15 July 2025
Summary
CVE-2025-34115 is a high-severity Improper Input Validation (CWE-20) vulnerability in Githubusercontent (inferred from references). Its CVSS base score is 8.7 (High).
Operationally, ranked in the top 1.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
An authenticated command injection vulnerability exists in OP5 Monitor through version 7.1.9 in the configuration section of the web interface. The flaw is triggered via the cmd_str parameter passed to the command_test.php endpoint, allowing a logged-in user to abuse the "Test this command" feature. It is tracked under CWE-20, CWE-78, and CWE-306, carries a CVSS 4.0 score of 8.7, and was corrected in release 7.2.0.
An attacker who possesses valid credentials and access to the command-testing functionality can supply crafted input that results in arbitrary shell command execution on the server as the unprivileged web-application user. The attack is network-reachable, requires no user interaction beyond authentication, and grants the attacker the ability to read, modify, or delete data accessible to that account.
Public exploit code, including a Metasploit module and an Exploit-DB entry, has been available for the issue, and the vendor advisory from ITRS Group along with the VulnCheck entry confirm the patch in 7.2.0 as the primary mitigation. The associated EPSS score has remained steady at 0.7072.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-21432
Vulnerability details
An authenticated command injection vulnerability exists in OP5 Monitor through version 7.1.9 via the 'cmd_str' parameter in the command_test.php endpoint. A user with access to the web interface can exploit the 'Test this command' feature to execute arbitrary shell commands…
more
as the unprivileged web application user. The vulnerability resides in the configuration section of the application and requires valid login credentials with access to the command testing functionality. This issue is fixed in version 7.2.0.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Directly implements checks on information inputs to reject invalid data before processing.
Requires established identification and authentication to unlock, mitigating missing authentication for continued system access.
Requiring identification and rationale for actions allowed without authentication ensures critical functions are not left unprotected by forcing review of authentication requirements.
Authorizing mobile device connections to organizational systems ensures authentication is performed for this critical access function.
Guarantees critical functions are protected by mandatory invocation of the access control mechanism.
Auditing sessions makes it possible to detect access to critical functions without required authentication.
The assessment process confirms authentication is present and effective for critical functions, preventing exploitation from missing authentication.
Certification assesses that critical functions have required authentication controls in place.