Authentication Bypass Vulnerability in GFI Kerio Control by GFI Software

CVE-2025-34069

What is CVE-2025-34069?

An authentication bypass vulnerability exists in the GFI Kerio Control version 9.4.5 due to an insecure default proxy configuration and inadequate access control in the GFIAgent service. The non-transparent proxy operating on TCP port 3128 can allow unauthenticated requests to be forwarded to internal services, circumventing firewall protections and revealing sensitive endpoints. This vulnerability lets malicious actors access the GFIAgent service on ports 7995 and 7996, potentially gaining the appliance UUID and executing administrative commands through the proxy. The implications of this flaw include unauthorized administrative access to the Kerio Control appliance, highlighting a significant risk for network security.

References