PT-2025-32553 · Openfiler · Openfiler

Published 2025-08-11 · Updated 2025-08-11 · CVE-2012-10040

Positive Technologies (AI Summary)

CVSS v4.0

9.4

Critical

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions: Openfiler versions 2.x

Description: Openfiler v2.x contains a command injection issue in the system.html page. The device parameter is used to create a NetworkCard object, and its constructor in network.inc calls exec() with unsanitized input. An authenticated attacker can exploit this to execute arbitrary commands as the openfiler user. Due to incorrect sudoers configuration, the openfiler user can escalate privileges to root using sudo /bin/bash without a password.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2012-10040

Affected Products

Openfiler

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2012-10040 · Security Note
• https://sourceforge.net/projects/openfiler · Note
• http://web.archive.org/web/20210922060411/https://itsecuritysolutions.org/2012-09-06-Openfiler-v2.x-multiple-vulnerabilities · Note
• https://t.me/CVEtracker/29689 · Telegram Post
• https://openfiler.com · Note
• https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/http/openfiler_networkcard_exec.rb · Note
• https://exploit-db.com/exploits/21191 · Note