PT-2025-32464 · Emqx · Emqx

Ricardojoserf · Published 2025-08-10 · Updated 2025-08-10 · CVE-2025-52136

Positive Technologies (AI Summary)

CVSS v3.1

3.0

Low

Base vector

AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions: EMQX versions prior to 5.8.6

Description: Administrators could install arbitrary novel plugins via the Dashboard web interface. The supplier considers this intended behavior; however, version 5.8.6 introduced a defense-in-depth feature requiring CLI approval for plugin installation using the emqx ctl plugins allow command.

Recommendations: Upgrade to version 5.8.6 or later.

Exploit

Fix

Improper Check for Exceptional Conditions

Weakness Enumeration

CWE-754

Related Identifiers

CVE-2025-52136

Affected Products

Emqx

References · 9

• 🔥 https://github.com/ricardojoserf/emqx-RCE · Exploit
• https://osv.dev/vulnerability/CVE-2025-52136 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-52136 · Security Note
• https://twitter.com/VulmonFeeds/status/1954399928811217180 · Twitter Post
• https://twitter.com/f8sbrightermind/status/1954408434381513189 · Twitter Post
• https://t.me/cveNotify/131581 · Telegram Post
• https://docs.emqx.com/en/emqx/latest/deploy/install-docker.html · Note
• https://docs.emqx.com/en/emqx/latest/dashboard/introduction.html · Note
• https://t.me/CVEtracker/29606 · Telegram Post