Read the docs
TI-2025-24445 Aliases CVE-2025-34312GHSA-32xv-355r-2ff6

IPFire < v2.29 Command Injection via URL Filter Blacklist

Priority MEDIUM 44CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

IPFire versions prior to 2.29 (Core Update 198) contain a command injection vulnerability that allows an authenticated attacker to execute arbitrary commands as the 'nobody' user via the BE_NAME parameter when installing a blacklist. When a blacklist is installed the application issues an HTTP POST to /cgi-bin/urlfilter.cgi and interpolates the value of BE_NAME directly into a shell invocation without appropriate sanitation. Crafted input can inject shell metacharacters, leading to arbitrary command execution in the context of the 'nobody' user.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.02238 82nd percentileScored 2026-11-07
Fix Fixed IPFire (IPFire.org): 2.29 (Core Update 198)

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
IPFire.orgIPFirebefore 2.29 (Core Update 198)2.29 (Core Update 198)Patch availableCNA
  • IPFire VendorIPFire.org Affected before 2.29 (Core Update 198) Fixed in 2.29 (Core Update 198) Patch available CNA

CPE configurations NVD · 16

CPEVersionsRoleVendor
cpe:2.3:a:ipfire:ipfire:*:*:*:*:*:*:*:*before 2.29VulnerableIPFire.org
cpe:2.3:a:ipfire:ipfire:2.29:core_update183:*:*:*:*:*:*2.29 core_update183VulnerableIPFire.org
cpe:2.3:a:ipfire:ipfire:2.29:core_update184:*:*:*:*:*:*2.29 core_update184VulnerableIPFire.org
cpe:2.3:a:ipfire:ipfire:2.29:core_update185:*:*:*:*:*:*2.29 core_update185VulnerableIPFire.org
cpe:2.3:a:ipfire:ipfire:2.29:core_update186:*:*:*:*:*:*2.29 core_update186VulnerableIPFire.org
cpe:2.3:a:ipfire:ipfire:2.29:core_update187:*:*:*:*:*:*2.29 core_update187VulnerableIPFire.org
cpe:2.3:a:ipfire:ipfire:2.29:core_update188:*:*:*:*:*:*2.29 core_update188VulnerableIPFire.org
cpe:2.3:a:ipfire:ipfire:2.29:core_update189:*:*:*:*:*:*2.29 core_update189VulnerableIPFire.org
cpe:2.3:a:ipfire:ipfire:2.29:core_update190:*:*:*:*:*:*2.29 core_update190VulnerableIPFire.org
cpe:2.3:a:ipfire:ipfire:2.29:core_update191:*:*:*:*:*:*2.29 core_update191VulnerableIPFire.org
  • cpe:2.3:a:ipfire:ipfire:*:*:*:*:*:*:*:* Versions before 2.29 Vulnerable ·IPFire.org
  • cpe:2.3:a:ipfire:ipfire:2.29:core_update183:*:*:*:*:*:* Versions 2.29 core_update183 Vulnerable ·IPFire.org
  • cpe:2.3:a:ipfire:ipfire:2.29:core_update184:*:*:*:*:*:* Versions 2.29 core_update184 Vulnerable ·IPFire.org
  • cpe:2.3:a:ipfire:ipfire:2.29:core_update185:*:*:*:*:*:* Versions 2.29 core_update185 Vulnerable ·IPFire.org
  • cpe:2.3:a:ipfire:ipfire:2.29:core_update186:*:*:*:*:*:* Versions 2.29 core_update186 Vulnerable ·IPFire.org
  • cpe:2.3:a:ipfire:ipfire:2.29:core_update187:*:*:*:*:*:* Versions 2.29 core_update187 Vulnerable ·IPFire.org
  • cpe:2.3:a:ipfire:ipfire:2.29:core_update188:*:*:*:*:*:* Versions 2.29 core_update188 Vulnerable ·IPFire.org
  • cpe:2.3:a:ipfire:ipfire:2.29:core_update189:*:*:*:*:*:* Versions 2.29 core_update189 Vulnerable ·IPFire.org
  • cpe:2.3:a:ipfire:ipfire:2.29:core_update190:*:*:*:*:*:* Versions 2.29 core_update190 Vulnerable ·IPFire.org
  • cpe:2.3:a:ipfire:ipfire:2.29:core_update191:*:*:*:*:*:* Versions 2.29 core_update191 Vulnerable ·IPFire.org
Show 6 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:ipfire:ipfire:2.29:core_update192:*:*:*:*:*:*2.29 core_update192VulnerableIPFire.org
cpe:2.3:a:ipfire:ipfire:2.29:core_update193:*:*:*:*:*:*2.29 core_update193VulnerableIPFire.org
cpe:2.3:a:ipfire:ipfire:2.29:core_update194:*:*:*:*:*:*2.29 core_update194VulnerableIPFire.org
cpe:2.3:a:ipfire:ipfire:2.29:core_update195:*:*:*:*:*:*2.29 core_update195VulnerableIPFire.org
cpe:2.3:a:ipfire:ipfire:2.29:core_update196:*:*:*:*:*:*2.29 core_update196VulnerableIPFire.org
cpe:2.3:a:ipfire:ipfire:2.29:core_update197:*:*:*:*:*:*2.29 core_update197VulnerableIPFire.org
  • cpe:2.3:a:ipfire:ipfire:2.29:core_update192:*:*:*:*:*:* Versions 2.29 core_update192 Vulnerable ·IPFire.org
  • cpe:2.3:a:ipfire:ipfire:2.29:core_update193:*:*:*:*:*:* Versions 2.29 core_update193 Vulnerable ·IPFire.org
  • cpe:2.3:a:ipfire:ipfire:2.29:core_update194:*:*:*:*:*:* Versions 2.29 core_update194 Vulnerable ·IPFire.org
  • cpe:2.3:a:ipfire:ipfire:2.29:core_update195:*:*:*:*:*:* Versions 2.29 core_update195 Vulnerable ·IPFire.org
  • cpe:2.3:a:ipfire:ipfire:2.29:core_update196:*:*:*:*:*:* Versions 2.29 core_update196 Vulnerable ·IPFire.org
  • cpe:2.3:a:ipfire:ipfire:2.29:core_update197:*:*:*:*:*:* Versions 2.29 core_update197 Vulnerable ·IPFire.org

Remediation

  • Fix · CNA IPFire (IPFire.org) Fixed in 2.29 (Core Update 198)

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    IPFire.org IPFire — ipfire.org/blog/ipfire-2-29-core-update-198-released

    18 records Highest priority Priority MEDIUM 2 MEDIUM, 16 LOW

    Other records, highest priority first

    • TI-2025-24444 IPFire < v2.29 Command Injection via Proxy Report CreationPriority MEDIUM 54
    • TI-2025-24442 IPFire < v2.29 Stored XSS via Dynamic DNS HostPriority LOW 31
    • TI-2025-24437 IPFire < v2.29 SQL Injection via OpenVPN Connection LogsPriority LOW 31
    Show all 18 records → Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-34312
  2. 2026-10-03 Alias added: GHSA-32xv-355r-2ff6

References

Patch 1

Advisory 1

  • TI-2021-12837 lfs/backup in IPFire 2.25-core155 does not ensure that /var/ipfire/backup/bin/backup.pl… CVSS 3.1HIGH 8.8
  • TI-2017-07141 IPFire 2.19 has a Remote Command Injection vulnerability in ids.cgi via the OINKCODE… CVSS 3.0HIGH 8.8
  • TI-2025-32283 IPFire 2.29 DNS management interface (dns.cgi) fails to properly sanitize user-supplied… CVSS 3.1MEDIUM 6.1
  • TI-2025-32282 IPFire 2.29 web-based firewall interface (firewall.cgi) fails to sanitize several rule… CVSS 3.1MEDIUM 5.4
  • TI-2025-24444 IPFire < v2.29 Command Injection via Proxy Report Creation CVSS 4.0HIGH 8.7
  • TI-2018-11622 An authenticated command injection vulnerability exists in IPFire Firewall before 2.21… CVSS 3.1HIGH 8.8
See all 31 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences