{"id":"CVE-2025-34116","state":"PUBLISHED","title":"IPFire < 2.19 Core Update 101 proxy.cgi RCE","description":"A remote command execution vulnerability exists in IPFire before version 2.19 Core Update 101 via the 'proxy.cgi' CGI interface. An authenticated attacker can inject arbitrary shell commands through crafted values in the NCSA user creation form fields, leading to command execution with web server privileges.","publishedAt":"2025-07-15T13:02:31.571Z","updatedAt":"2026-05-15T11:14:46.343Z","severity":{"score":8.7,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","source":"VulnCheck"},"assigner":"VulnCheck","products":["IPFire Project IPFire"],"affected":[{"vendor":"IPFire Project","product":"IPFire","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"2.19 Core Update 101","versionType":"custom"}],"modules":["proxy.cgi"],"platforms":["Linux"]}],"references":["https://www.ipfire.org/news/ipfire-2-19-core-update-101-released","https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/http/ipfire_proxy_exec.rb","https://www.exploit-db.com/exploits/39765","https://www.asafety.fr/en/vuln-exploit-poc/xss-rce-ipfire-2-19-core-update-101-remote-command-execution/","https://bugzilla.ipfire.org/show_bug.cgi?id=11087","https://www.vulncheck.com/advisories/ipfire-authenticated-rce"],"weaknesses":["CWE-78","CWE-20","CWE-306"],"ingestedAt":"2026-10-29T20:09:03.054Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/34xxx/CVE-2025-34116.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-34116","state":"PUBLISHED","datePublished":"2025-07-15T13:02:31.571Z","dateUpdated":"2026-05-15T11:14:46.343Z","assignerShortName":"VulnCheck","assignerOrgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateReserved":"2025-04-15T19:15:22.560Z"},"containers":{"cna":{"title":"IPFire < 2.19 Core Update 101 proxy.cgi RCE","descriptions":[{"lang":"en","value":"A remote command execution vulnerability exists in IPFire before version 2.19 Core Update 101 via the 'proxy.cgi' CGI interface. An authenticated attacker can inject arbitrary shell commands through crafted values in the NCSA user creation form fields, leading to command execution with web server privileges."}],"affected":[{"vendor":"IPFire Project","product":"IPFire","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"2.19 Core Update 101","versionType":"custom"}],"modules":["proxy.cgi"],"platforms":["Linux"]}],"references":[{"url":"https://www.ipfire.org/news/ipfire-2-19-core-update-101-released","tags":["vendor-advisory","patch"]},{"url":"https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/http/ipfire_proxy_exec.rb","tags":["exploit"]},{"url":"https://www.exploit-db.com/exploits/39765","tags":["exploit"]},{"url":"https://www.asafety.fr/en/vuln-exploit-poc/xss-rce-ipfire-2-19-core-update-101-remote-command-execution/","tags":["third-party-advisory","technical-description"]},{"url":"https://bugzilla.ipfire.org/show_bug.cgi?id=11087","tags":["issue-tracking"]},{"url":"https://www.vulncheck.com/advisories/ipfire-authenticated-rce","tags":["third-party-advisory"]}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":8.7,"baseSeverity":"HIGH","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-78","description":"CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","lang":"en","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-20","description":"CWE-20 Improper Input Validation","lang":"en","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-306","description":"CWE-306 Missing Authentication for Critical Function","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"VulnCheck","orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateUpdated":"2026-05-15T11:14:46.343Z"},"cpeApplicability":[{"operator":"OR","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:ipfire:ipfire:2.19:*:*:*:*:*:*:*","versionEndExcluding":"core_update101"}]}]}],"credits":[{"lang":"en","type":"finder","value":"Yann Cam"}],"impacts":[{"capecId":"CAPEC-88","descriptions":[{"lang":"en","value":"CAPEC-88 OS Command Injection"}]}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"vulncheck"},"datePublic":"2016-05-04T00:00:00.000Z"},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-07-15T13:37:55.718926Z","id":"CVE-2025-34116","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-07-15T13:38:14.339Z"}}]}}}