Cyber Resilience

CVE-2025-43984

CriticalRCE

Published: 14 August 2025

Published
14 August 2025
Modified
15 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0299 86.8th percentile
Risk Priority 21 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-43984 is a critical-severity OS Command Injection (CWE-78) vulnerability in Proton (inferred from references). Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 13.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).

Deeper analysis

CVE-2025-43984 affects KuWFi GC111 devices running hardware version CPE-LM321_V3.2 and software version GC111-GL-LM321_V3.0_20191211. The flaw is an OS command injection vulnerability (CWE-78) that permits unauthenticated access to the /goform/goform_set_cmd_process endpoint. A remote attacker can supply a crafted SSID value in a POST request to execute arbitrary operating system commands as root.

Any network-reachable attacker can exploit the issue without authentication or user interaction, achieving full control over the device including the ability to install persistent malware, exfiltrate data, or pivot into attached networks. The CVSS 3.1 base score of 9.8 reflects the combination of network attack vector, low complexity, and high impact on confidentiality, integrity, and availability.

Public references consist of proof-of-concept material hosted on GitHub and a Proton drive link along with the vendor product page; none of the listed sources describe official patches, firmware updates, or mitigation steps. The associated EPSS score has remained flat at 0.0299 with no observed rise after disclosure.

EU & UK References

Vulnerability details

An issue was discovered on KuWFi GC111 devices (Hardware Version: CPE-LM321_V3.2, Software Version: GC111-GL-LM321_V3.0_20191211). They are vulnerable to unauthenticated /goform/goform_set_cmd_process requests. A crafted POST request, using the SSID parameter, allows remote attackers to execute arbitrary OS commands with root privileges.

CWE(s)
CWE-78

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

Unauthenticated command injection in a network-exposed web endpoint directly enables remote exploitation of a public-facing application for root OS command execution.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2026-4631Shared CWE-78
CVE-2026-42062Shared CWE-78
CVE-2025-41709Shared CWE-78
CVE-2025-56819Shared CWE-78
CVE-2026-34176Shared CWE-78
CVE-2020-37125Shared CWE-78
CVE-2026-34387Shared CWE-78
CVE-2026-32968Shared CWE-78
CVE-2025-60803Shared CWE-78
CVE-2026-25111Shared CWE-78

Affected Assets

Proton
—
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Requires validation of untrusted inputs like the SSID parameter in POST requests to /goform/goform_set_cmd_process, directly preventing command injection exploitation.

AC-3 Access Enforcement good match
prevent

Enforces approved authorizations, blocking unauthenticated remote access to the vulnerable endpoint and preventing arbitrary command execution.

SI-2 Flaw Remediation good match
prevent

Mandates identification, reporting, and correction of flaws like this command injection vulnerability through timely patching or firmware updates.

References