CVE-2025-34311
Published: 28 October 2025
Summary
CVE-2025-34311 is a high-severity OS Command Injection (CWE-78) vulnerability in Ipfire Ipfire. Its CVSS base score is 8.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Unix Shell (T1059.004); ranked in the top 37.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-34311 is a command injection vulnerability (CWE-78) in IPFire versions prior to 2.29 Core Update 198. The flaw occurs in the Proxy report creation feature, where the application processes an HTTP POST request to /cgi-bin/logs.cgi/calamaris.dat. Parameters including DAY_BEGIN, MONTH_BEGIN, YEAR_BEGIN, DAY_END, MONTH_END, YEAR_END, NUM_DOMAINS, PERF_INTERVAL, NUM_CONTENT, HIST_LEVEL, NUM_HOSTS, NUM_URLS, and BYTE_UNIT are read and directly interpolated into a shell invocation of the mkreport helper without sanitization for shell metacharacters or improper constructs.
An authenticated attacker with low privileges can exploit this vulnerability over the network with low attack complexity and no user interaction. Exploitation involves crafting a POST request with injected shell metacharacters into one or more parameters, enabling execution of arbitrary commands as the 'nobody' user. The CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects high impacts on confidentiality, integrity, and availability.
IPFire addresses the vulnerability in version 2.29 Core Update 198. Mitigation details are provided in the IPFire Bugzilla entry (https://bugzilla.ipfire.org/show_bug.cgi?id=13886), the Core Update 198 release announcement (https://www.ipfire.org/blog/ipfire-2-29-core-update-198-released), and the VulnCheck advisory (https://www.vulncheck.com/advisories/ipfire-command-injection-via-proxy-report-creation).
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-36508
Vulnerability details
IPFire versions prior to 2.29 (Core Update 198) contain a command injection vulnerability that allows an authenticated attacker to execute arbitrary commands as the user 'nobody' via multiple parameters when creating a Proxy report. When a user creates a Proxy…
more
report the application issues an HTTP POST to /cgi-bin/logs.cgi/calamaris.dat and reads the values of DAY_BEGIN, MONTH_BEGIN, YEAR_BEGIN, DAY_END, MONTH_END, YEAR_END, NUM_DOMAINS, PERF_INTERVAL, NUM_CONTENT, HIST_LEVEL, NUM_HOSTS, NUM_URLS, and BYTE_UNIT, which are interpolated directly into the shell invocation of the mkreport helper. Because these parameters are never sanitized for improper characters or constructs, a crafted POST can inject shell metacharacters into one or more fields, causing arbitrary commands to run with the privileges of the 'nobody' user.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is a command injection (CWE-78) in a CGI script that interpolates unsanitized parameters into a shell command (mkreport), directly enabling T1059.004 (Unix Shell). As a remotely exploitable web application flaw, it facilitates T1190 (Exploit Public-Facing Application).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents command injection by requiring validation and sanitization of HTTP POST parameters like DAY_BEGIN before shell interpolation.
Mitigates the vulnerability through timely flaw remediation by applying IPFire Core Update 198, which fixes the unsanitized parameter handling.
Limits damage from injected commands by enforcing least privilege, restricting execution to the low-privileged 'nobody' user.