PT-2025-49043 · Thermo Fisher+1 · Torrent Suite+1

Published

2025-12-04

·

Updated

2025-12-16

·

CVE-2025-54306

CVSS v3.1

7.2

High

VectorAV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Thermo Fisher Torrent Suite Django application version 5.18.1
Description A remote code execution issue exists in the network configuration functionality due to inadequate input validation when handling network configuration parameters via administrative endpoints. The application permits administrators to alter the server’s network configuration through the Django application. This configuration is processed by Bash scripts (TSsetnoproxy and TSsetproxy) that directly write user-controlled data to environment variables without sufficient sanitization. Executing a source command on /etc/environment after updating these variables can enable arbitrary command execution if an attacker injects malicious data into environment variables. The vulnerability originates at the /admin/network endpoint, which utilizes user-supplied form data as arguments in subprocess.Popen calls. This input is then used to update environment variables within TSsetnoproxy and TSsetproxy, followed by the execution of source /etc/environment.
Recommendations Update to a newer version that contains a fix for this vulnerability.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2025-54306

Affected Products

Django
Torrent Suite