PT-2025-14379 · Infinxt · Infinxt Iedge 100

Published 2025-04-01 · Updated 2025-04-05 · CVE-2025-26056

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Infinxt iEdge 100 version 2.1.32

Description A command injection issue exists in the Troubleshoot module's "MTR" functionality due to improper validation of user-supplied input in the mtrIp parameter. This allows an attacker to execute arbitrary operating system commands on the underlying system with the same privileges as the web application process.

Recommendations For Infinxt iEdge 100 version 2.1.32, consider disabling the "MTR" functionality in the Troubleshoot module until a patch is available to prevent exploitation of the command injection flaw. Restrict access to the mtrIp parameter to minimize the risk of arbitrary command execution.

Exploit

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2025-26056

Affected Products

Infinxt Iedge 100

References · 5

• 🔥 https://github.com/rohan-pt/CVE-2025-26056 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-26056 · Security Note
• https://t.me/cvetracker/20507 · Telegram Post
• https://t.me/cvedetector/21802 · Telegram Post
• https://twitter.com/CVEnew/status/1908663717312815367 · Twitter Post