PT-2025-29545 · Wepresent · Wepresent Wipg-1000

Matthias Brun · Published 2025-07-15 · Updated 2025-07-15 · CVE-2025-34103

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions WePresent WiPG-1000 versions prior to 2.2.3.0

Description An unauthenticated command injection issue exists due to improper input handling in the /cgi-bin/rdfs.cgi endpoint. The Client parameter is not sanitized before being passed to a system call, potentially allowing an unauthenticated remote attacker to execute arbitrary commands as the web server user.

Recommendations Update to version 2.2.3.0 or later.

Exploit

Fix

Missing Authentication

OS Command Injection

Weakness Enumeration

CWE-306

CWE-78

Related Identifiers

CVE-2025-34103

Affected Products

Wepresent Wipg-1000

References · 7

• 🔥 https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/http/wipg1000_cmd_injection.rb · Exploit
• 🔥 https://exploit-db.com/exploits/41935 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-34103 · Security Note
• https://twitter.com/VulmonFeeds/status/1945149015970001014 · Twitter Post
• https://redguard.ch/advisories/wepresent-wipg1000.txt · Note
• https://twitter.com/CVEnew/status/1945118951501176995 · Twitter Post
• https://vulncheck.com/advisories/we-present-wi-pg-1000-unauthenticated-command-injection · Note