High severity · published Jul 15, 2025
CVE-2025-34116
IPFire < 2.19 Core Update 101 proxy.cgi RCE
8.7
CVSS
1.9%
EPSS
No
On KEV
Description
A remote command execution vulnerability exists in IPFire before version 2.19 Core Update 101 via the 'proxy.cgi' CGI interface. An authenticated attacker can inject arbitrary shell commands through crafted values in the NCSA user creation form fields, leading to command execution with web server privileges.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.9% · higher than 80% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IP
IPFire · IPFire Project
before 2.19 Core Update 101 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-34116
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-34116
bugzilla.ipfire.org
https://bugzilla.ipfire.org/show_bug.cgi?id=11087
raw.githubusercontent.com
https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/http/ipfire_proxy_exec.rb
www.asafety.fr
https://www.asafety.fr/en/vuln-exploit-poc/xss-rce-ipfire-2-19-core-update-101-remote-command-execution/
www.exploit-db.com
https://www.exploit-db.com/exploits/39765
www.ipfire.org
https://www.ipfire.org/news/ipfire-2-19-core-update-101-released
www.vulncheck.com
https://www.vulncheck.com/advisories/ipfire-authenticated-rce
More from IPFire
4.8
CVE-2022-36368
Multiple stored cross-site scripting vulnerabilities in the web user interface of IPFire versions prior to 2.27 allows a remote authenticated attacker with administrative…