GFI Software

Records64All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical8CVSS 9.0–10.0

CVSS high14CVSS 7.0–8.9

Exploited now

GFI Software records in CISA KEV

No GFI Software vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Mailessentials 22 records HIGH Archiver 8 records MEDIUM Helpdesk 5 records LOW Kerio Connect 5 records HIGH Kerio Control 5 records HIGH Mailsecurity 3 records MEDIUM Gfi Backup 2009 1 record LOW Kerio Connect Client 1 record LOW

Records

5 records in Kerio Control · all components

TI-2025-24238 CVE-2025-34070 · GHSA-gxh5-69f2-j43w

GFI Kerio Control GFIAgent Missing Authentication on Administrative Interfaces

HIGH 82

A missing authentication vulnerability in the GFIAgent component of GFI Kerio Control 9.4.5 allows unauthenticated remote attackers to perform privileged operations.

CVSS 4.0CRITICAL 10.0 Network No auth No interaction EPSS 0.0076 Published 2025-07-02 No fix listed CWE-306

TI-2025-24239 CVE-2025-34071 · GHSA-p7cq-wxfh-7j76

GFI Kerio Control Unsigned System Image Upload Root Code Execution

HIGH 76

A remote code execution vulnerability in GFI Kerio Control 9.4.5 allows attackers with administrative access to upload and execute arbitrary code through the firmware upgrade feature.

CVSS 4.0CRITICAL 9.4 Network High privileges No interaction EPSS 0.00813 Published 2025-07-02 No fix listed CWE-306

TI-2025-24237 CVE-2025-34069 · GHSA-rf49-98vq-w8qg

GFI Kerio Control GFIAgent Authentication Bypass via Proxy Forwarding

HIGH 74

An authentication bypass vulnerability exists in GFI Kerio Control 9.4.5 due to insecure default proxy configuration and weak access control in the GFIAgent service.

CVSS 4.0CRITICAL 9.5 Network No auth No interaction EPSS 0.00766 Published 2025-07-02 No fix listed CWE-306

TI-2024-35379 CVE-2024-52875 · GHSA-wwwq-jmfm-4f5c

HTTP response splitting in GFI Software Kerio Control

HIGH 73

An issue was discovered in GFI Kerio Control 9.2.5 through 9.4.5.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.29386 Published 2025-01-31 No fix listed CWE-113

TI-2019-12344 CVE-2019-16414 · GHSA-8rg5-2cpw-hhhw

A DOM based XSS in GFI Kerio Control v9.3.0 allows embedding of malicious code and…

LOW 30

A DOM based XSS in GFI Kerio Control v9.3.0 allows embedding of malicious code and manipulating the login page to send back a victim's cleartext credentials to an attacker via a login/?reason=failure&NTLM= URI.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01566 Published 2019-09-30 No fix listed CWE-79

Open these records in search →

Critical	8
High	14
Medium	42
Low	0
No CVSS	0