PT-2026-1886 · Foomuuri · Foomuuri

Matthias Gerstner · Published 2026-01-07 · Updated 2026-05-27 · CVE-2025-67858

Positive Technologies (AI Summary)

CVSS v4.0

7.0

High

Base vector

AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Foomuuri versions prior to 0.27-2+deb13u1 Foomuuri versions prior to 0.31

Description An Improper Neutralization of Argument Delimiters issue exists in Foomuuri, potentially leading to integrity loss of the firewall configuration or other unspecified impacts. This occurs through manipulation of the JSON configuration passed to nft. The issue is triggered by a crafted interface input parameter.

Recommendations Upgrade Foomuuri packages to version 0.27-2+deb13u1. For versions prior to 0.31, upgrade to a later version.

Fix

Argument Injection

Weakness Enumeration

CWE-88

Related Identifiers

CVE-2025-67858

DSA-6095-1

USN-8326-1

Affected Products

Foomuuri

References · 16

• https://security-tracker.debian.org/tracker/CVE-2025-67858 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-6095-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-8326-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-67858 · Security Note
• https://cve.org/CVERecord?id=CVE-2025-67858 · Security Note
• https://osv.dev/vulnerability/USN-8326-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-67858 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-67858 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-67858 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-67603 · Vendor Advisory
• https://twitter.com/CVEnew/status/2009291486651638220 · Twitter Post
• https://bugzilla.suse.com/show_bug.cgi?id=CVE-2025-67858 · Note
• https://security.opensuse.org/2026/01/07/foomuuri-lack-of-dbus-authorization.html · Note
• https://twitter.com/oss_security/status/2009490893716508926 · Twitter Post
• https://openwall.com/lists/oss-security/2026/01/07/9 · Note