CVE-2025-58443
CriticalCVSS 9.1Exploitation Probability (EPSS)
Very high risk97th percentile - higher than 97% of all known CVEs
Summary
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Versions 1.5.10.1673 and below contain an authentication bypass vulnerability. It is possible for an attacker to perform an unauthenticated DB dump where they could pull a full SQL DB without credentials. A fix is expected to be released 9/15/2025.
Risk Assessment
An attacker could gain full access to the database without authentication, potentially leading to data leakage or system integrity compromise.
Recommendation
Immediately upgrade FOG to the latest version of either the dev-branch or working-1.6 branch to patch the vulnerability.
Other vulnerabilities in FOG
See all- CVE-2026-47689Medium
FOG prior to versions 1.5.10.1832 and 1.6.0-beta.2313 contains an HTML/JavaScript injection vulnerability. An unauthenticated attacker knowing a host's MAC address can POST malicious inventory values to /service/inventory.php, which are stored in the database. When an admin opens the Group Inventory tab, the payload executes in the admin's browser.
- CVE-2026-47688High
Vulnerability in FOG (imaging/inventory management system). An unauthenticated attacker can remotely wipe AES keys and delete power management tasks via a single HTTP GET request.
- CVE-2026-47687High
XSS vulnerability in FOG (open-source cloning/imaging tool) allows an unauthenticated attacker who knows a host's MAC address to inject malicious JavaScript via the sysproduct parameter. The payload executes in the admin's browser when viewing inventory reports.
- CVE-2026-47685High
Vulnerability in FOG, a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the unauthenticated inventory service endpoint (`/service/inventory.php`) persists client-supplied values without sanitization, and the Host Management Inventory page renders static inventory fields without output encoding, allowing stored XSS in any administrator's browser.
Original NVD description (English source)
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Versions 1.5.10.1673 and below contain an authentication bypass vulnerability. It is possible for an attacker to perform an unauthenticated DB dump where they could pull a full SQL DB without credentials. A fix is expected to be released 9/15/2025. To address this vulnerability immediately, upgrade to the latest version of either the dev-branch or working-1.6 branch. This will patch the issue for users concerned about immediate exposure. See the FOG Project documentation for step-by-step upgrade instructions: https://docs.fogproject.org/en/latest/install-fog-server#choosing-a-fog-version.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS