Vulnerability · Published Jun 3, 2025 · Assigned by VulDB

CVE-2025-5525Jrohy trojan linux.go LogChan os command injection

Medium 5.6

In plain English

A medium-severity OS command injection in trojan from Jrohy. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 3.0% (higher than 87% of all known vulnerabilities).

Severity (CVSS 3.1)5.6Medium

Exploit odds (30 days)3.0%top 12.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability was found in Jrohy trojan up to 2.15.3. It has been declared as critical. This vulnerability affects the function LogChan of the file trojan/util/linux.go. The manipulation of the argument c leads to os command injection. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used.

Affected products (as reported)

Vendor	Product	Versions
Jrohy	trojan	2.15.02.15.12.15.22.15.3

Weakness: CWE-78, CWE-77 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

References

VDB-310966 | Jrohy trojan linux.go LogChan os command injection vdb-entry, technical-description
VDB-310966 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
Submit #586673 | https://github.com/Jrohy https://github.com/Jrohy/trojan v2.15.3 Command Injection third-party-advisory
https://github.com/ainrm/Jrohy-trojan-unauth-poc/blob/main/README.en.md exploit
https://github.com/Tritium0041/Jrohy-trojan-RCE-POC/blob/main/POC.py exploit