CVE-2025-34071

Katalog CVE

CVSS 9.8 · Critical EPSS 0,81%

Kerentanan Missing Authentication for Critical Function pada gfi kerio control. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

A remote code execution vulnerability in GFI Kerio Control 9.4.5 allows attackers with administrative access to upload and execute arbitrary code through the firmware upgrade feature. The system upgrade mechanism accepts unsigned .img files, which can be modified to include malicious scripts within the upgrade.sh or disk image components. These modified upgrade images are not validated for authenticity or integrity, and are executed by the system post-upload, enabling root access.

Rincian

Terbit di NVD

2 Juli 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-306: Missing Authentication for Critical Function

EPSS (30 hari)

0,81% peluang dieksploitasi; lebih tinggi dari 55,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://ssd-disclosure.com/ssd-advisory-kerio-control-authentication-bypass-and-rce/ exploit · advisory pihak ketiga
• https://vulncheck.com/advisories/gfi-kerio-control-auth-bypass-rce advisory pihak ketiga