CVE-2025-34311
HighCVSS 8.8Exploitation Probability (EPSS)
Very high risk96th percentile - higher than 96% of all known CVEs
Summary
IPFire versions prior to 2.29 (Core Update 198) contain a command injection vulnerability that allows an authenticated attacker to execute arbitrary commands as the user 'nobody' via multiple parameters when creating a Proxy report. Parameters such as DAY_BEGIN, MONTH_BEGIN, YEAR_BEGIN, DAY_END, MONTH_END, YEAR_END, NUM_DOMAINS, PERF_INTERVAL, NUM_CONTENT, HIST_LEVEL, NUM_HOSTS, NUM_URLS, and BYTE_UNIT are interpolated directly into the shell invocation without sanitization.
Risk Assessment
An authenticated attacker can execute arbitrary commands with the privileges of the 'nobody' user, potentially leading to further privilege escalation and firewall compromise.
Recommendation
Update IPFire to version 2.29 (Core Update 198) or later.
Other vulnerabilities in IPFire
See all- CVE-2017-9757High
IPFire 2.19 has a Remote Command Injection vulnerability in ids.cgi via the OINKCODE parameter, which is mishandled by a shell. This can be exploited directly by authenticated users, or through CSRF.
- CVE-2025-34318Medium
IPFire versions prior to 2.29 (Core Update 198) contain a stored cross-site scripting (XSS) vulnerability that allows an authenticated attacker to inject arbitrary JavaScript code through the TLS_HOSTNAME, UPSTREAM_USER, UPSTREAM_PASSWORD, ADMIN_MAIL_ADDRESS, and ADMIN_PASSWORD parameters when adding a new DNS entry. The values are stored and later rendered in the web interface without proper sanitation or encoding.
- CVE-2025-34316Medium
IPFire versions prior to 2.29 (Core Update 198) contain a stored XSS vulnerability allowing an authenticated attacker to inject arbitrary JavaScript via the txt_mailuser and txt_mailpass parameters when updating mail server settings. Values are stored and rendered without proper encoding.
- CVE-2025-34315Medium
IPFire versions prior to 2.29 (Core Update 198) contain a stored XSS vulnerability allowing an authenticated attacker to inject arbitrary JavaScript via the REMOTELOG_ADDR parameter when updating the remote syslog server address. The value is stored and rendered without proper encoding.
- CVE-2025-34312High
IPFire versions prior to 2.29 (Core Update 198) contain a command injection vulnerability. An authenticated attacker can execute arbitrary commands as the 'nobody' user via the BE_NAME parameter when installing a blacklist, as the value is interpolated into a shell invocation without proper sanitation.
Original NVD description (English source)
IPFire versions prior to 2.29 (Core Update 198) contain a command injection vulnerability that allows an authenticated attacker to execute arbitrary commands as the user 'nobody' via multiple parameters when creating a Proxy report. When a user creates a Proxy report the application issues an HTTP POST to /cgi-bin/logs.cgi/calamaris.dat and reads the values of DAY_BEGIN, MONTH_BEGIN, YEAR_BEGIN, DAY_END, MONTH_END, YEAR_END, NUM_DOMAINS, PERF_INTERVAL, NUM_CONTENT, HIST_LEVEL, NUM_HOSTS, NUM_URLS, and BYTE_UNIT, which are interpolated directly into the shell invocation of the mkreport helper. Because these parameters are never sanitized for improper characters or constructs, a crafted POST can inject shell metacharacters into one or more fields, causing arbitrary commands to run with the privileges of the 'nobody' user.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS