Progress Flowmon CVE-2025-10239
HIGHAttack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain Flowmon admin credentials
-
DeliveryAuthenticate to management interface
-
ExploitInvoke troubleshooting script with injected commands
-
ExecutionBreak out to underlying OS shell
-
ImpactExecute arbitrary commands, full appliance compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated account with administrator privileges AND network access to the Flowmon management interface; the attacker then abuses the built-in troubleshooting scripts feature to inject and execute additional unintended OS commands. The limiting factor is the PR:H requirement - this is not reachable by an unauthenticated or low-privileged user, so realistic risk is confined to malicious administrators, stolen/compromised admin credentials, or chaining from a separate access-gaining flaw. Fixed in Flowmon 12.5.5. |
| Impact | This is a high-CVSS but gated, post-authentication issue rather than a mass-exploitation priority. The CVSS 3.1 vector (7.2) is network-reachable (AV:N) and low-complexity (AC:L) with full CIA impact, but the decisive metric is PR:H - exploitation requires an account that already holds administrator privileges on the Flowmon management interface. In effect this is an admin-to-underlying-OS command-execution escalation (breaking out of the constrained troubleshooting-script interface into arbitrary OS commands), not a path for an external unauthenticated attacker. EPSS is low at 0.38% (30th percentile), there is no CISA KEV listing, and no public exploit code was identified, all of which are consistent with a flaw that is real but not broadly weaponizable. The signals are internally consistent: the CVSS network vector does not contradict the description, because the management interface is network-served but still demands admin authentication. The practical risk is therefore moderate and concentrated in insider-threat, compromised-admin-credential, or defense-in-depth scenarios where an attacker who has already reached admin wants to fully own the appliance host. |
| Exploit ScenarioDerived | An attacker who has obtained Flowmon administrator credentials (via phishing, credential reuse, or a prior compromise) logs into the management interface and invokes the built-in troubleshooting scripts, injecting additional shell commands into a parameter that is passed to the OS without adequate sanitization. This yields arbitrary command execution on the appliance's underlying operating system, converting restricted admin access into full host control. No public proof-of-concept exploit was identified at the time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 01, 2026
An OS command injection flaw in the Progress Flowmon management interface lets an authenticated administrator abuse the built-in troubleshooting scripts feature to run additional unintended commands on the underlying system. Only Flowmon deployments prior to 12.5.5 are affected, and exploitation requires network reachability to the management interface plus a valid administrator-level account, so the realistic exposure is limited to malicious insiders, compromised or stolen admin credentials, or chaining from a separate access-gaining vulnerability. There is no public exploit identified at time of analysis and no evidence of active exploitation; EPSS is low at roughly 0.38% (30th percentile), making this a high-CVSS but gated, post-authentication issue rather than a mass-exploitation priority.
RemediationAI
Upgrade to Flowmon 12.5.5, which is the vendor-released patch for CVE-2025-10239, following the instructions in the Progress advisory at https://community.progress.com/s/article/CVE-2025-10239; verify the installed version after upgrading and re-check any deployment that was restored from a pre-12.5.5 snapshot. Until the upgrade can be scheduled, the effective compensating controls focus on the PR:H precondition: restrict management-interface access to a dedicated administrative VLAN or a short list of jump hosts and block it from general user and internet-reachable networks, require multi-factor authentication and unique accounts for Flowmon administrators, and remove or disable dormant admin accounts. Trade-offs to weigh are that tightening the management network can disrupt legitimate remote operations and monitoring integrations, MFA can complicate automated admin tooling, and the troubleshooting scripts themselves cannot be selectively disabled without vendor guidance, so any attempt to lock down that feature may reduce your ability to perform diagnostics. Because exploitation requires valid admin credentials, treat any history of compromised or shared admin accounts on pre-12.5.5 systems as a potential compromise indicator and review audit logs for anomalous command execution during troubleshooting sessions.
Affected ProductsAI
Progress Flowmon versions prior to 12.5.5 are affected; the issue is fixed in Flowmon 12.5.5. No CPE identifiers were supplied with the available intelligence, so coverage should be validated against the vendor advisory at https://community.progress.com/s/article/CVE-2025-10239, which is the authoritative source for the exact build and appliance variants (physical, virtual, and cloud) remediated by the 12.5.5 release.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is a classic OS command injection primitive (CWE-78) inside the diagnostic/troubleshooting script functionality exposed by the Flowmon management console. Instead of constraining user-supplied input to the intended diagnostic arguments, the scripts pass it to a shell, so an administrator who already has access to that interface can append or substitute commands and have them executed with the privileges of the Flowmon service. The CVSS:3.1 vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H confirms remote network reachability and no user interaction, but also that confidentiality, integrity, and availability impact is total once the high-privilege precondition is met, and that impact stays within the vulnerable component's security scope. Because the injection point sits behind the authenticated admin UI rather than an unauthenticated API or network service, this is best classified as a post-authentication privilege/execution escalation on the appliance rather than a pre-auth remote code execution vector.
Know when Flowmon gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Management interface is network-reachable (AV:N) and the injection is straightforward (AC:L), but admin authentication is mandatory (PR:H); OS command execution yields full host CIA with no scope change.
Primary rating from Vendor (progress).
CVSS VectorVendor: progress
DescriptionCVE.org
In Flowmon versions prior to 12.5.5, a vulnerability has been identified that allows a user with administrator privileges and access to the management interface to execute additional unintended commands within scripts intended for troubleshooting purposes.
Executive ViewAI
Progress Flowmon deployments prior to 12.5.5 carry an OS command injection exposure in the management interface that could let an actor holding administrator-level access execute unintended commands on the underlying appliance. Because the flaw is gated by valid privileged credentials and management-network reachability, the practical business risk centers on insider misuse, compromised admin accounts, or chained attacks rather than broad opportunistic exploitation. No public exploit identified at time of analysis, so leadership should prioritize privileged-access governance and management-plane exposure reduction while tracking vendor remediation.
Restrict management-interface network access to trusted administrative segments; enforce least privilege, MFA, and just-in-time administration for Flowmon administrator accounts; monitor and audit troubleshooting-script execution; segment the Flowmon appliance from critical systems; and apply vendor mitigations when released. No vendor-released patch identified at time of analysis.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
In Flowmon versions prior to 11.1.14 and 12.3.5, an operating system command injection vulnerability has been identified
Privilege escalation via incorrect authorization in Progress Flowmon lets an authenticated low-privileged user abuse the
Progress Flowmon versions prior to 12.5.8 allow authenticated low-privileged users to execute arbitrary commands on the
Progress Flowmon 12.x and 13.0.x contain a cross-site scripting (XSS) vulnerability allowing authenticated attackers to
GitHub PoC
Exploit-DB