IPFire < 2.19 Core Update 101 proxy.cgi RCE
Priority MEDIUM 43CWE-20Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass, Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-306 and CWE-78.
Summary
A remote command execution vulnerability exists in IPFire before version 2.19 Core Update 101 via the 'proxy.cgi' CGI interface. An authenticated attacker can inject arbitrary shell commands through crafted values in the NCSA user creation form fields, leading to command execution with web server privileges.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01943 80th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by the CNA
Fix Fixed IPFire (IPFire Project): 2.19 Core Update 101
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| IPFire Project | IPFire | before 2.19 Core Update 101 | 2.19 Core Update 101 | Patch available | CNA |
- IPFire VendorIPFire Project Affected before 2.19 Core Update 101 Fixed in 2.19 Core Update 101 Patch available CNA
Remediation
- Fix · CNA IPFire (IPFire Project) Fixed in 2.19 Core Update 101
Timeline
- 2026-10-02 Threatist record created from CVE-2025-34116
- 2026-10-03 Alias added: GHSA-gx74-wv49-wwfv
References
Exploit 2
Sources
- CVE-2025-34116 · CVE Program
- CVE-2025-34116 · NVD
- FIRST EPSS
- GHSA-gx74-wv49-wwfv · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences