Which versions of OP5 Monitor are affected by CVE-2025-34115?

OP5 Monitor through version 7.1.9 contains a command injection vulnerability in the command_test.php endpoint that allows authenticated users to execute arbitrary commands on the underlying Linux…

Is there a public PoC exploit available for CVE-2025-34115?

Yes, a public proof-of-concept exploit is available for CVE-2025-34115. Prioritise patching immediately. EPSS: 3.3%.

How to fix or mitigate CVE-2025-34115?

Within 24 hours, inventory all OP5 Monitor deployments and document current versions of each instance. Within 7 days, implement firewall or WAF rules to restrict network access to the command_test.php endpoint to only necessary administrative systems, and audit current user privileges to remove unnecessary account access to OP5 Monitor-particularly limiting low-privilege accounts that may be compromised through other vectors. Within 30 days, contact Altinity (OP5 vendor) to confirm patch availability timelines for versions beyond 7.1.9, and begin planning an upgrade or migration strategy; establish monthly vendor communication cadence to track patch status if no immediate fix is released.

OP5 Monitor CVE-2025-34115

Q: What is the CVSS score of CVE-2025-34115?

CVE-2025-34115 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 3.3%.

HIGH

Improper Input Validation (CWE-20)

2025-07-15 disclosure@vulncheck.com

PHP Command Injection

8.7

CVSS 4.0 · Vendor: vulncheck

Severity by source

Vendor (vulncheck) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Network-accessible PHP endpoint exploitable by any low-privilege authenticated user; scope unchanged as execution is constrained to the unprivileged web process.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (vulncheck).

CVSS VectorVendor: vulncheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Sep 08, 2026 - 21:36 vuln.today

CVE Published

Jul 15, 2025 - 13:15 cve.org

HIGH 8.7

DescriptionCVE.org

An authenticated command injection vulnerability exists in OP5 Monitor through version 7.1.9 via the 'cmd_str' parameter in the command_test.php endpoint. A user with access to the web interface can exploit the 'Test this command' feature to execute arbitrary shell commands as the unprivileged web application user. The vulnerability resides in the configuration section of the application and requires valid login credentials with access to the command testing functionality. This issue is fixed in version 7.2.0.

AnalysisAI

Command injection in OP5 Monitor through version 7.1.9 allows any authenticated low-privilege user to execute arbitrary shell commands on the underlying Linux host via the unsanitized cmd_str parameter in the command_test.php endpoint. Commands execute as the unprivileged web application user, providing a reliable foothold for further post-exploitation. A Metasploit module (op5_config_exec.rb) and an Exploit-DB entry (39676) fully weaponize this vulnerability, and the EPSS score at the 88th percentile reflects elevated real-world exploitation likelihood despite the absence of a CISA KEV listing.

Technical ContextAI

OP5 Monitor is a commercial Linux-based network monitoring platform, now maintained by ITRS Group. The application is built on PHP and exposes a configuration interface including a 'Test this command' feature at command_test.php. The cmd_str POST parameter, which accepts the command string to test, is passed to the underlying shell without adequate sanitization or input validation - the root cause class identified by CWE-20 (Improper Input Validation). The web server process executes the injected payload as an unprivileged system account. No CPE string was provided in the input; affected versions are confirmed to span all releases through 7.1.9.

Affected ProductsAI

OP5 Monitor through version 7.1.9 on Linux-based deployments is affected. The product is now maintained by ITRS Group, whose product page is at https://www.itrsgroup.com/products/network-monitoring-op5-monitor. No CPE string was provided in the input data, so affected versions are derived from the CVE description alone. The vulnerability is fixed in version 7.2.0.

RemediationAI

Upgrade OP5 Monitor to version 7.2.0 or later, which resolves this issue per the CVE description. The VulnCheck advisory at https://www.vulncheck.com/advisories/op5-monitor-authenticated-command-execution should be consulted for vendor-specific guidance. If immediate upgrade is not feasible, restrict access to command_test.php at the web server or network perimeter level to deny access to that endpoint entirely - this disables the vulnerable feature but prevents exploitation without disrupting the broader application. Additionally, enforcing principle of least privilege by limiting which user roles have access to the configuration section reduces the attack surface. Note that removing access to the 'Test this command' feature may affect legitimate command validation workflows.