Read the docs
TI-2025-24444 Aliases CVE-2025-34311GHSA-qxm8-6g78-524j

IPFire < v2.29 Command Injection via Proxy Report Creation

Priority MEDIUM 54CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

IPFire versions prior to 2.29 (Core Update 198) contain a command injection vulnerability that allows an authenticated attacker to execute arbitrary commands as the user 'nobody' via multiple parameters when creating a Proxy report. When a user creates a Proxy report the application issues an HTTP POST to /cgi-bin/logs.cgi/calamaris.dat and reads the values of DAY_BEGIN, MONTH_BEGIN, YEAR_BEGIN, DAY_END, MONTH_END, YEAR_END, NUM_DOMAINS, PERF_INTERVAL, NUM_CONTENT, HIST_LEVEL, NUM_HOSTS, NUM_URLS, and BYTE_UNIT, which are interpolated directly into the shell invocation of the mkreport helper. Because these parameters are never sanitized for improper characters or constructs, a crafted POST can inject shell metacharacters into one or more fields, causing arbitrary commands to run with the privileges of the 'nobody' user.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.13451 96th percentileScored 2026-11-07
Fix Fixed IPFire (IPFire.org): 2.29 (Core Update 198)

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
IPFire.orgIPFirebefore 2.29 (Core Update 198)2.29 (Core Update 198)Patch availableCNA
  • IPFire VendorIPFire.org Affected before 2.29 (Core Update 198) Fixed in 2.29 (Core Update 198) Patch available CNA

CPE configurations NVD · 16

CPEVersionsRoleVendor
cpe:2.3:a:ipfire:ipfire:*:*:*:*:*:*:*:*before 2.29VulnerableIPFire.org
cpe:2.3:a:ipfire:ipfire:2.29:core_update183:*:*:*:*:*:*2.29 core_update183VulnerableIPFire.org
cpe:2.3:a:ipfire:ipfire:2.29:core_update184:*:*:*:*:*:*2.29 core_update184VulnerableIPFire.org
cpe:2.3:a:ipfire:ipfire:2.29:core_update185:*:*:*:*:*:*2.29 core_update185VulnerableIPFire.org
cpe:2.3:a:ipfire:ipfire:2.29:core_update186:*:*:*:*:*:*2.29 core_update186VulnerableIPFire.org
cpe:2.3:a:ipfire:ipfire:2.29:core_update187:*:*:*:*:*:*2.29 core_update187VulnerableIPFire.org
cpe:2.3:a:ipfire:ipfire:2.29:core_update188:*:*:*:*:*:*2.29 core_update188VulnerableIPFire.org
cpe:2.3:a:ipfire:ipfire:2.29:core_update189:*:*:*:*:*:*2.29 core_update189VulnerableIPFire.org
cpe:2.3:a:ipfire:ipfire:2.29:core_update190:*:*:*:*:*:*2.29 core_update190VulnerableIPFire.org
cpe:2.3:a:ipfire:ipfire:2.29:core_update191:*:*:*:*:*:*2.29 core_update191VulnerableIPFire.org
  • cpe:2.3:a:ipfire:ipfire:*:*:*:*:*:*:*:* Versions before 2.29 Vulnerable ·IPFire.org
  • cpe:2.3:a:ipfire:ipfire:2.29:core_update183:*:*:*:*:*:* Versions 2.29 core_update183 Vulnerable ·IPFire.org
  • cpe:2.3:a:ipfire:ipfire:2.29:core_update184:*:*:*:*:*:* Versions 2.29 core_update184 Vulnerable ·IPFire.org
  • cpe:2.3:a:ipfire:ipfire:2.29:core_update185:*:*:*:*:*:* Versions 2.29 core_update185 Vulnerable ·IPFire.org
  • cpe:2.3:a:ipfire:ipfire:2.29:core_update186:*:*:*:*:*:* Versions 2.29 core_update186 Vulnerable ·IPFire.org
  • cpe:2.3:a:ipfire:ipfire:2.29:core_update187:*:*:*:*:*:* Versions 2.29 core_update187 Vulnerable ·IPFire.org
  • cpe:2.3:a:ipfire:ipfire:2.29:core_update188:*:*:*:*:*:* Versions 2.29 core_update188 Vulnerable ·IPFire.org
  • cpe:2.3:a:ipfire:ipfire:2.29:core_update189:*:*:*:*:*:* Versions 2.29 core_update189 Vulnerable ·IPFire.org
  • cpe:2.3:a:ipfire:ipfire:2.29:core_update190:*:*:*:*:*:* Versions 2.29 core_update190 Vulnerable ·IPFire.org
  • cpe:2.3:a:ipfire:ipfire:2.29:core_update191:*:*:*:*:*:* Versions 2.29 core_update191 Vulnerable ·IPFire.org
Show 6 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:ipfire:ipfire:2.29:core_update192:*:*:*:*:*:*2.29 core_update192VulnerableIPFire.org
cpe:2.3:a:ipfire:ipfire:2.29:core_update193:*:*:*:*:*:*2.29 core_update193VulnerableIPFire.org
cpe:2.3:a:ipfire:ipfire:2.29:core_update194:*:*:*:*:*:*2.29 core_update194VulnerableIPFire.org
cpe:2.3:a:ipfire:ipfire:2.29:core_update195:*:*:*:*:*:*2.29 core_update195VulnerableIPFire.org
cpe:2.3:a:ipfire:ipfire:2.29:core_update196:*:*:*:*:*:*2.29 core_update196VulnerableIPFire.org
cpe:2.3:a:ipfire:ipfire:2.29:core_update197:*:*:*:*:*:*2.29 core_update197VulnerableIPFire.org
  • cpe:2.3:a:ipfire:ipfire:2.29:core_update192:*:*:*:*:*:* Versions 2.29 core_update192 Vulnerable ·IPFire.org
  • cpe:2.3:a:ipfire:ipfire:2.29:core_update193:*:*:*:*:*:* Versions 2.29 core_update193 Vulnerable ·IPFire.org
  • cpe:2.3:a:ipfire:ipfire:2.29:core_update194:*:*:*:*:*:* Versions 2.29 core_update194 Vulnerable ·IPFire.org
  • cpe:2.3:a:ipfire:ipfire:2.29:core_update195:*:*:*:*:*:* Versions 2.29 core_update195 Vulnerable ·IPFire.org
  • cpe:2.3:a:ipfire:ipfire:2.29:core_update196:*:*:*:*:*:* Versions 2.29 core_update196 Vulnerable ·IPFire.org
  • cpe:2.3:a:ipfire:ipfire:2.29:core_update197:*:*:*:*:*:* Versions 2.29 core_update197 Vulnerable ·IPFire.org

Remediation

  • Fix · CNA IPFire (IPFire.org) Fixed in 2.29 (Core Update 198)

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    IPFire.org IPFire — ipfire.org/blog/ipfire-2-29-core-update-198-released

    18 records Highest priority Priority MEDIUM 2 MEDIUM, 16 LOW

    Other records, highest priority first

    • TI-2025-24445 IPFire < v2.29 Command Injection via URL Filter BlacklistPriority MEDIUM 44
    • TI-2025-24442 IPFire < v2.29 Stored XSS via Dynamic DNS HostPriority LOW 31
    • TI-2025-24437 IPFire < v2.29 SQL Injection via OpenVPN Connection LogsPriority LOW 31
    Show all 18 records → Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-34311
  2. 2026-10-03 Alias added: GHSA-qxm8-6g78-524j

References

Patch 1

Advisory 1

  • TI-2021-12837 lfs/backup in IPFire 2.25-core155 does not ensure that /var/ipfire/backup/bin/backup.pl… CVSS 3.1HIGH 8.8
  • TI-2017-07141 IPFire 2.19 has a Remote Command Injection vulnerability in ids.cgi via the OINKCODE… CVSS 3.0HIGH 8.8
  • TI-2025-32283 IPFire 2.29 DNS management interface (dns.cgi) fails to properly sanitize user-supplied… CVSS 3.1MEDIUM 6.1
  • TI-2025-32282 IPFire 2.29 web-based firewall interface (firewall.cgi) fails to sanitize several rule… CVSS 3.1MEDIUM 5.4
  • TI-2018-11622 An authenticated command injection vulnerability exists in IPFire Firewall before 2.21… CVSS 3.1HIGH 8.8
  • TI-2025-24445 IPFire < v2.29 Command Injection via URL Filter Blacklist CVSS 4.0HIGH 8.7
See all 31 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences