CVE-2025-34311

HighPublic PoCRCE

Published: 28 October 2025

Published

28 October 2025

Modified

03 November 2025

KEV Added

—

Patch

—

CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0040 60.8th percentile

Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-34311 is a high-severity OS Command Injection (CWE-78) vulnerability in Ipfire Ipfire. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Unix Shell (T1059.004); ranked in the top 39.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Unix Shell (T1059.004) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match

prevent

Directly prevents command injection by requiring validation and sanitization of HTTP POST parameters like DAY_BEGIN before shell interpolation.

SI-2 Flaw Remediation good match

prevent

Mitigates the vulnerability through timely flaw remediation by applying IPFire Core Update 198, which fixes the unsanitized parameter handling.

AC-6 Least Privilege partial match

prevent

Limits damage from injected commands by enforcing least privilege, restricting execution to the low-privileged 'nobody' user.

MITRE ATT&CK Enterprise TechniquesAI

T1059.004 Unix Shell Execution

Adversaries may abuse Unix shell commands and scripts for execution.

attack.mitre.org →

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

The vulnerability is a command injection (CWE-78) in a CGI script that interpolates unsanitized parameters into a shell command (mkreport), directly enabling T1059.004 (Unix Shell). As a remotely exploitable web application flaw, it facilitates T1190 (Exploit Public-Facing Application).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

NVD Description

IPFire versions prior to 2.29 (Core Update 198) contain a command injection vulnerability that allows an authenticated attacker to execute arbitrary commands as the user 'nobody' via multiple parameters when creating a Proxy report. When a user creates a Proxy…

report the application issues an HTTP POST to /cgi-bin/logs.cgi/calamaris.dat and reads the values of DAY_BEGIN, MONTH_BEGIN, YEAR_BEGIN, DAY_END, MONTH_END, YEAR_END, NUM_DOMAINS, PERF_INTERVAL, NUM_CONTENT, HIST_LEVEL, NUM_HOSTS, NUM_URLS, and BYTE_UNIT, which are interpolated directly into the shell invocation of the mkreport helper. Because these parameters are never sanitized for improper characters or constructs, a crafted POST can inject shell metacharacters into one or more fields, causing arbitrary commands to run with the privileges of the 'nobody' user.

Deeper analysisAI

CVE-2025-34311 is a command injection vulnerability (CWE-78) in IPFire versions prior to 2.29 Core Update 198. The flaw occurs in the Proxy report creation feature, where the application processes an HTTP POST request to /cgi-bin/logs.cgi/calamaris.dat. Parameters including DAY_BEGIN, MONTH_BEGIN, YEAR_BEGIN, DAY_END, MONTH_END, YEAR_END, NUM_DOMAINS, PERF_INTERVAL, NUM_CONTENT, HIST_LEVEL, NUM_HOSTS, NUM_URLS, and BYTE_UNIT are read and directly interpolated into a shell invocation of the mkreport helper without sanitization for shell metacharacters or improper constructs.

An authenticated attacker with low privileges can exploit this vulnerability over the network with low attack complexity and no user interaction. Exploitation involves crafting a POST request with injected shell metacharacters into one or more parameters, enabling execution of arbitrary commands as the 'nobody' user. The CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects high impacts on confidentiality, integrity, and availability.

IPFire addresses the vulnerability in version 2.29 Core Update 198. Mitigation details are provided in the IPFire Bugzilla entry (https://bugzilla.ipfire.org/show_bug.cgi?id=13886), the Core Update 198 release announcement (https://www.ipfire.org/blog/ipfire-2-29-core-update-198-released), and the VulnCheck advisory (https://www.vulncheck.com/advisories/ipfire-command-injection-via-proxy-report-creation).