CVE-2025-50674
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
In OpenMediaVault 7.4.17, a vulnerability was discovered in the changePassword method in file /usr/share/php/openmediavault/system/user.inc, allowing local authenticated attackers to escalate privileges to root.
Risk Assessment
The organization is at risk of a local user gaining full root control over the system, potentially leading to unauthorized data access, configuration changes, or complete server compromise.
Recommendation
Immediately update OpenMediaVault to the latest patched version and restrict local access to trusted users only.
Other vulnerabilities in OpenMediaVault
See all- CVE-2013-3632High
The Cron service in rpc.php in OpenMediaVault allows remote authenticated users to execute cron jobs as arbitrary users and execute arbitrary commands via the username parameter.
- CVE-2026-52102Critical
An OS command injection vulnerability in the openmediavault-md plugin of OpenMediaVault v8.0.4-1 allows attackers to execute arbitrary commands as root via injecting shell metacharacters.
Original NVD description (English source)
An issue was discovered in the changePassword method in file /usr/share/php/openmediavault/system/user.inc in OpenMediaVault 7.4.17 allowing local authenticated attackers to escalate privileges to root.