OS Command Injection Vulnerability in Blue Angel Software Suite on Embedded Linux Devices

CVE-2025-34033

What is CVE-2025-34033?

An OS command injection vulnerability has been identified in the Blue Angel Software Suite, a solution utilized within embedded Linux devices. This flaw arises from inadequate input sanitization of the ping_addr parameter in the webctrl.cgi script. Authenticated attackers can exploit this by submitting malicious GET requests with specially crafted parameters, allowing them to execute arbitrary system commands. The results of these commands are reflected in the application’s web interface, offering attackers visibility and interaction with the system. The vulnerability can be further exploited through the use of default or backdoor credentials, enabling comprehensive command execution as root.

References