PT-2025-44170 · Ipfire · Ipfire

Alex Williams · Published 2025-10-28 · Updated 2025-10-29 · CVE-2025-34311

Positive Technologies · (AI Summary)

CVSS v3.1

8.8

High

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions IPFire versions prior to 2.29 (Core Update 198)

Description IPFire versions prior to 2.29 (Core Update 198) contain a command injection issue. An authenticated attacker can execute arbitrary commands as the 'nobody' user through multiple parameters when creating a Proxy report. The application issues an HTTP POST request to the /cgi-bin/logs.cgi/calamaris.dat endpoint and reads values from parameters including DAY BEGIN, MONTH BEGIN, YEAR BEGIN, DAY END, MONTH END, YEAR END, NUM DOMAINS, PERF INTERVAL, NUM CONTENT, HIST LEVEL, NUM HOSTS, NUM URLS, and BYTE UNIT. These parameters are directly interpolated into a shell invocation of the mkreport helper without proper sanitization, allowing for the injection of shell metacharacters and execution of arbitrary commands with 'nobody' user privileges.

Recommendations Update to IPFire version 2.29 (Core Update 198) or later.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2025-34311

Affected Products

Ipfire

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-34311 · Security Note
• https://osv.dev/vulnerability/CVE-2025-34311 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1983338439039676891 · Twitter Post
• https://vulncheck.com/advisories/ipfire-command-injection-via-proxy-report-creation · Note
• https://ipfire.org/blog/ipfire-2-29-core-update-198-released · Patch, Vendor Advisory
• https://bugzilla.ipfire.org/show_bug.cgi?id=13886 · Note
• https://twitter.com/CVEnew/status/1983191519835095117 · Twitter Post
• https://twitter.com/CveFindCom/status/1983189562542141719 · Twitter Post