Vulnerability · Published Jul 15, 2025 · Assigned by VulnCheck

CVE-2025-34116IPFire < 2.19 Core Update 101 proxy.cgi RCE

High 8.7

In plain English

A high-severity OS command injection in IPFire from IPFire Project. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.9% (higher than 80% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit.

Severity (CVSS 4.0)8.7High

Exploit odds (30 days)1.9%top 19.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Metasploit

Official description

A remote command execution vulnerability exists in IPFire before version 2.19 Core Update 101 via the 'proxy.cgi' CGI interface. An authenticated attacker can inject arbitrary shell commands through crafted values in the NCSA user creation form fields, leading to command execution with web server privileges.

Affected products (as reported)

Vendor	Product	Versions
IPFire Project	IPFire	0 – before 2.19 Core Update 101

Weakness: CWE-78, CWE-20, CWE-306 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

https://www.ipfire.org/news/ipfire-2-19-core-update-101-released vendor-advisory, patch
https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/http/ipfire_proxy_exec.rb exploit
https://www.exploit-db.com/exploits/39765 exploit
https://www.asafety.fr/en/vuln-exploit-poc/xss-rce-ipfire-2-19-core-update-101-remote-command-execution/ third-party-advisory, technical-description
https://bugzilla.ipfire.org/show_bug.cgi?id=11087 issue-tracking
https://www.vulncheck.com/advisories/ipfire-authenticated-rce third-party-advisory