PT-2025-17597 · Git+1 · 3X-Ui

Sausagenoods · Published 2025-04-22 · Updated 2025-07-01 · CVE-2025-29331

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: 3X-UI versions prior to 2.5.3

Description: The issue allows a remote attacker to execute arbitrary code via the management script. This is possible because the x-ui passes the no check certificate option to wget when downloading updates, which means it does not verify certificates when downloading menu updates.

Recommendations: For versions prior to 2.5.3, update to version 2.5.3 or later to resolve the issue. As a temporary workaround, consider disabling the automatic update feature in the management script until a patch is available. Restrict access to the wget command with the no check certificate option to minimize the risk of exploitation. Avoid using the x-ui management script for downloading updates until the issue is resolved.

Fix

RCE

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2025-29331

Affected Products

3X-Ui

References · 8

• https://github.com/MHSanaei/3x-ui/pull/2661 · Patch
• https://osv.dev/vulnerability/CVE-2025-29331 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-29331 · Security Note
• https://twitter.com/cracbot/status/1940002510690718177 · Twitter Post
• https://twitter.com/digilolnet/status/1914801685362593792 · Twitter Post
• https://twitter.com/CVEnew/status/1938249463199359429 · Twitter Post
• https://t.me/cvetracker/27131 · Telegram Post
• https://digilol.net/security-advisories/dlsec2025-001.html · Note