CVE-2025-34116
Published: 15 July 2025
Summary
CVE-2025-34116 is a high-severity Improper Input Validation (CWE-20) vulnerability in Ipfire (inferred from references). Its CVSS base score is 8.7 (High).
Operationally, ranked in the top 1.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
A remote command execution vulnerability affects IPFire versions prior to 2.19 Core Update 101 in the proxy.cgi CGI interface. The flaw stems from insufficient input validation in the NCSA user creation form fields, allowing injection of arbitrary shell commands that execute with web server privileges. It is tracked under CWE-20, CWE-78, and CWE-306 with a CVSS 4.0 score of 8.7.
An authenticated attacker with access to the web interface can supply crafted values in the affected form fields to achieve remote command execution. This enables full control over actions permitted by the web server account, including potential lateral movement or further privilege escalation within the appliance.
The official IPFire advisory for Core Update 101 addresses the issue by releasing a patched version that resolves the command injection vector in proxy.cgi. Public exploit code, including a Metasploit module and entries on Exploit-DB, has been available since disclosure.
The EPSS score stands at 0.7623 with no material rise from a lower baseline, indicating sustained rather than newly emerging exploitation interest.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-21433
Vulnerability details
A remote command execution vulnerability exists in IPFire before version 2.19 Core Update 101 via the 'proxy.cgi' CGI interface. An authenticated attacker can inject arbitrary shell commands through crafted values in the NCSA user creation form fields, leading to command…
more
execution with web server privileges.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Directly implements checks on information inputs to reject invalid data before processing.
Requires established identification and authentication to unlock, mitigating missing authentication for continued system access.
Requiring identification and rationale for actions allowed without authentication ensures critical functions are not left unprotected by forcing review of authentication requirements.
Authorizing mobile device connections to organizational systems ensures authentication is performed for this critical access function.
Guarantees critical functions are protected by mandatory invocation of the access control mechanism.
Auditing sessions makes it possible to detect access to critical functions without required authentication.
The assessment process confirms authentication is present and effective for critical functions, preventing exploitation from missing authentication.
Certification assesses that critical functions have required authentication controls in place.