RCE in Itrs Group Op5 Monitor
CVE-2025-34115
An authenticated command injection vulnerability exists in OP5 Monitor through version 7.1.9 via the 'cmd_str' parameter in the command_test.php endpoint. A user with access to the web interface can exploit the 'Test this command' feature to execute arbitrary shell commands as the unprivileged web application user. The vulnerability resides in the configuration section of the application and requires valid login credentials with access to the command testing functionality. This issue is fixed in version 7.2.0.
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
EPSS: 0.023 (81.7th percentile) — read the EPSS interpretation.
Affected products
- Itrs Group Op5 Monitor — versions 0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- disclosure@vulncheck.com (exploit)
- disclosure@vulncheck.com (exploit)
- disclosure@vulncheck.com (product)
- disclosure@vulncheck.com (third-party-advisory)
Frequently asked questions
- What is CVE-2025-34115?
- CVE-2025-34115 is a vulnerability in Itrs Group Op5 Monitor, classified under Improper Input Validation. Published 2025-07-15.
- Is CVE-2025-34115 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.