PT-2025-44171 · Ipfire · Ipfire

Alex Williams · Published 2025-10-28 · Updated 2025-10-29 · CVE-2025-34312

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions IPFire versions prior to 2.29 (Core Update 198)

Description IPFire versions prior to 2.29 (Core Update 198) contain a command injection issue. An authenticated attacker can execute arbitrary commands as the 'nobody' user. This occurs through the BE NAME parameter when installing a blacklist. The application sends an HTTP POST request to the /cgi-bin/urlfilter.cgi endpoint and incorporates the value of BE NAME directly into a shell command without proper sanitization. This allows for the injection of shell metacharacters, leading to arbitrary command execution with 'nobody' user privileges.

Recommendations Update IPFire to version 2.29 (Core Update 198) or later.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2025-34312

Affected Products

Ipfire

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-34312 · Security Note
• https://osv.dev/vulnerability/CVE-2025-34312 · Vendor Advisory
• https://twitter.com/CVEnew/status/1983185708966690939 · Twitter Post
• https://ipfire.org/blog/ipfire-2-29-core-update-198-released · Patch, Vendor Advisory
• https://bugzilla.ipfire.org/show_bug.cgi?id=13887 · Note
• https://vulncheck.com/advisories/ipfire-command-injection-via-url-filter-blacklist · Note
• https://twitter.com/CveFindCom/status/1983189532565504054 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1983328199682531330 · Twitter Post