PT-2025-31985 · Narcissus · Narcissus

Published 2025-08-05 · Updated 2025-08-05 · CVE-2012-10033

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Narcissus (affected versions not specified)

Description Narcissus is vulnerable to remote code execution due to improper input handling in its image configuration workflow. The backend.php script fails to sanitize the release parameter before passing it to the configure image() function. This function invokes the PHP passthru() function with the unsanitized input, allowing attackers to inject arbitrary system commands. Exploitation occurs via a crafted POST request, resulting in command execution under the web server’s context.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2012-10033

Affected Products

Narcissus

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2012-10033 · Security Note
• https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/webapp/narcissus_backend_exec.rb · Note
• https://web.archive.org/web/20101127002623/https://narcissus.angstrom-distribution.org · Note
• https://t.me/CVEtracker/29239 · Telegram Post
• https://exploit-db.com/exploits/22856 · Note
• https://vulncheck.com/advisories/narcissus-image-config-command-injection · Note
• https://exploit-db.com/exploits/22709 · Note