PT-2025-18077 · Usermin · Usermin

Published 2025-04-28 · Updated 2025-05-14 · CVE-2015-2079

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Usermin versions 0.980 through 1.x before 1.660

Description The issue allows remote code execution in uconfig save.cgi due to the use of the two-argument form of Perl open(). This affects Usermin, potentially allowing unauthorized access and code execution.

Recommendations For versions 0.980 through 1.x before 1.660, consider disabling the uconfig save.cgi script until a patch is available to prevent remote code execution. Restrict access to the sig file free function to minimize the risk of exploitation. Avoid using the vulnerable open() function in Perl scripts until the issue is resolved.

Exploit

Fix

RCE

Code Injection

Weakness Enumeration

CWE-96

CWE-94

Related Identifiers

CVE-2015-2079

Affected Products

Usermin

References · 7

• 🔥 https://code-white.com/blog/2015-05-cve-2015-2079-rce-usermin · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2015-2079 · Security Note
• https://t.me/cvetracker/22529 · Telegram Post
• https://twitter.com/cybercronai/status/1917226243843358806 · Twitter Post
• https://twitter.com/cybercronai/status/1916886486428930124 · Twitter Post
• https://t.me/cvenotify/122207 · Telegram Post
• https://code-white.com/public-vulnerability-list · Note