RCE in Ipfire Project
CVE-2025-34116
A remote command execution vulnerability exists in IPFire before version 2.19 Core Update 101 via the 'proxy.cgi' CGI interface. An authenticated attacker can inject arbitrary shell commands through crafted values in the NCSA user creation form fields, leading to command execution with web server privileges.
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
Published · last modified .
EPSS exploit prediction
EPSS: 0.018 (77.9th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 78th percentile — 77.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.017 · newest: 0.018 · change: +0.001
Affected products
- Ipfire Project — versions 0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- www.ipfire.org/news/ipfire-2-19-core-update-101-released (vendor-advisory, patch)
- raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/l… (exploit)
- www.exploit-db.com/exploits/39765 (exploit)
- www.asafety.fr/en/vuln-exploit-poc/xss-rce-ipfire-2-19-core-update-101-remote-c… (technical-description, third-party-advisory)
- bugzilla.ipfire.org/show_bug.cgi (issue-tracking)
- www.vulncheck.com/advisories/ipfire-authenticated-rce (third-party-advisory)
Frequently asked questions
- What is CVE-2025-34116?
- CVE-2025-34116 is a vulnerability in Ipfire Project, classified under Improper Input Validation. Published 2025-07-15.
- Is CVE-2025-34116 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.