CyberRota Analysis
This is a high severity vulnerability with a CVSS score of 8.8. Exploitation may require the attacker to be authenticated.
CVE
CVE-2025-34312
Severity
HIGH
CVSS
8.8
EPSS
2.30%
Original NVD Description
IPFire versions prior to 2.29 (Core Update 198) contain a command injection vulnerability that allows an authenticated attacker to execute arbitrary commands as the 'nobody' user via the BE_NAME parameter when installing a blacklist. When a blacklist is installed the application issues an HTTP POST to /cgi-bin/urlfilter.cgi and interpolates the value of BE_NAME directly into a shell invocation without appropriate sanitation. Crafted input can inject shell metacharacters, leading to arbitrary command execution in the context of the 'nobody' user.
Related CVEs
Other vulnerabilities affecting the same vendor(s)