PT-2025-29556 · Op5 · Op5 Monitor

Hyp3Rlinx · Published 2025-07-15 · Updated 2025-07-15 · CVE-2025-34115

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OP5 Monitor versions through 7.1.9

Description An authenticated command injection vulnerability exists in OP5 Monitor. A user with access to the web interface can exploit the 'Test this command' feature to execute arbitrary shell commands as the unprivileged web application user. The vulnerability resides in the configuration section of the application and requires valid login credentials with access to the command testing functionality. The vulnerable parameter is cmd str in the /command test.php endpoint.

Recommendations Update to version 7.2.0 or later.

Exploit

Fix

Missing Authentication

OS Command Injection

RCE

Weakness Enumeration

CWE-306

CWE-78

CWE-20

Related Identifiers

CVE-2025-34115

Affected Products

Op5 Monitor

References · 9

• 🔥 https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/http/op5_config_exec.rb · Exploit
• 🔥 https://exploit-db.com/exploits/39676 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-34115 · Security Note
• https://vulncheck.com/advisories/op5-monitor-authenticated-command-execution · Note
• https://itrsgroup.com/products/network-monitoring-op5-monitor · Note
• https://vulncheck/advisories/op5-monitor-authenticated-command-execution · Note
• https://twitter.com/CVEnew/status/1945118958669251029 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1945118296992264488 · Twitter Post
• https://t.me/cvetracker/27853 · Telegram Post