Command Injection Vulnerability in IPFire 2.29 Log Exporter
CVE-2025-50974

6.5MEDIUM

Key Information:

Vendor

IPFire

Status
IPFire
Vendor
CVE Published:
26 August 2025

What is CVE-2025-50974?

The log exporter CGI in IPFire 2.29 fails to properly sanitize user inputs, enabling unauthenticated remote attackers to execute arbitrary shell commands. By exploiting this vulnerability, attackers can manipulate various parameters in the CGI script to execute harmful commands on the underlying operating system. This poses a significant threat to the integrity and confidentiality of the affected system.

References

https://github.com/4rdr/proofs/blob/main/info/IPFire-2.29...

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.