Which versions of IPFire are affected by CVE-2025-34311?

Organizations running IPFire firewall distributions older than 2.29 (Core Update 198) are exposed to an attacker who holds any valid WebGUI credential obtaining shell-level command execution on the…

How to fix or mitigate CVE-2025-34311?

Within 24 hours, inventory every IPFire instance and record its version, flagging anything below 2.29 (Core Update 198); immediately restrict WebGUI reachability so it is exposed only on a dedicated management VLAN, jump host, or trusted administrative network and never directly to the internet, and audit all WebGUI accounts to remove stale or unnecessary low-privilege users, enforce unique strong credentials, and enable multi-factor authentication where supported. Within 7 days, deploy interim filtering in front of the management interface - a WAF, reverse proxy, or IDS/IPS signature - that rejects shell metacharacters (semicolons, pipes, ampersands, backticks, dollar signs, newlines) in the DAY_BEGIN, MONTH_BEGIN, YEAR_BEGIN, NUM_DOMAINS and BYTE_UNIT parameters posted to /cgi-bin/logs.cgi/calamaris.dat, and restrict who may request Calamaris/Proxy reports; simultaneously enable centralised logging of firewall and WebGUI activity and alert on anomalous POSTs to logs.cgi endpoints or unexpected shell processes running as the 'nobody' account. Within 30 days, treat patch status as not available per input and escalate with the vendor for an advisory timeline, while planning and testing an upgrade to IPFire 2.29 (Core Update 198) - the version boundary referenced as the fixed release - in a staging environment before production rollout; complete a compromise assessment covering local accounts, SSH keys, cron entries, certificate stores and altered firewall rules, and re-validate network segmentation so that any future appliance compromise cannot be used to pivot into trusted internal zones.

IPFire CVE-2025-34311

Q: What is the CVSS score of CVE-2025-34311?

CVE-2025-34311 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 13.8%.

HIGH

OS Command Injection (CWE-78)

2025-10-28 disclosure@vulncheck.com

Command Injection Ipfire

8.7

CVSS 4.0 · Vendor: vulncheck

Severity by source

Vendor (vulncheck) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Network-reachable WebGUI, low complexity, requires a low-privilege authenticated session (PR:L), no interaction; command execution as 'nobody' gives high C/I/A with scope unchanged (no privilege escalation).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (vulncheck).

CVSS VectorVendor: vulncheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Sep 26, 2026 - 00:30 vuln.today

CVE Published

Oct 28, 2025 - 15:16 cve.org

HIGH 8.7

DescriptionCVE.org

IPFire versions prior to 2.29 (Core Update 198) contain a command injection vulnerability that allows an authenticated attacker to execute arbitrary commands as the user 'nobody' via multiple parameters when creating a Proxy report. When a user creates a Proxy report the application issues an HTTP POST to /cgi-bin/logs.cgi/calamaris.dat and reads the values of DAY_BEGIN, MONTH_BEGIN, YEAR_BEGIN, DAY_END, MONTH_END, YEAR_END, NUM_DOMAINS, PERF_INTERVAL, NUM_CONTENT, HIST_LEVEL, NUM_HOSTS, NUM_URLS, and BYTE_UNIT, which are interpolated directly into the shell invocation of the mkreport helper. Because these parameters are never sanitized for improper characters or constructs, a crafted POST can inject shell metacharacters into one or more fields, causing arbitrary commands to run with the privileges of the 'nobody' user.

AnalysisAI

Authenticated command injection in the IPFire firewall distribution prior to 2.29 (Core Update 198) lets a low-privilege WebGUI user run arbitrary shell commands as the 'nobody' service account. When a Proxy (Calamaris) report is generated, the GUI POSTs to /cgi-bin/logs.cgi/calamaris.dat and passes fields such as DAY_BEGIN, MONTH_BEGIN, YEAR_BEGIN, NUM_DOMAINS and BYTE_UNIT straight into the mkreport helper without sanitization, so shell metacharacters in any of those fields are executed server-side. The issue is remotely reachable but requires valid GUI credentials and access to the firewall's management interface; there is no public exploit identified at time of analysis and no CISA KEV listing, though the assessed CVSS:3.1 vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H and the reported CVSS 8.7 reflect high confidentiality, integrity and availability impact within the compromised 'nobody' context.

Technical ContextAI

IPFire is a Linux-based firewall/router distribution whose administration is performed through a CGI-based Web GUI. The Calamaris proxy-report feature builds a report by invoking the mkreport helper through a shell; each report parameter submitted by the browser is concatenated into that command line. Because none of the parameters (DAY_BEGIN, MONTH_BEGIN, YEAR_BEGIN, DAY_END, MONTH_END, YEAR_END, NUM_DOMAINS, PERF_INTERVAL, NUM_CONTENT, HIST_LEVEL, NUM_HOSTS, NUM_URLS, BYTE_UNIT) are validated or escaped, the flaw is a classic CWE-78 OS command injection: shell metacharacters such as semicolons, backticks or command substitution sequences let the caller break out of the intended argument and append their own commands. CPE data confirms the affected component set across the IPFire 2.x line, listing generic IPFire ranges plus 2.29 builds core_update183 through core_update191, i.e. every Core Update shipped before the Core Update 198 fix. The injected commands run with the privileges of the 'nobody' account used by the report subsystem, which is unprivileged but still gives full read access to files that user can see and the ability to execute arbitrary binaries, potentially enabling lateral movement or persistence on the firewall host.

RemediationAI

Upgrade to IPFire 2.29 Core Update 198 or later, which is the vendor-released patch that fixes the unsanitized parameter interpolation in mkreport (see https://www.ipfire.org/blog/ipfire-2-29-core-update-198-released and upstream Bugzilla 13886). Where an immediate upgrade is not possible, restrict access to the WebGUI so that only fully trusted administrators on the internal management network can reach /cgi-bin/logs.cgi/calamaris.dat, since exploitation requires a valid GUI session and network reachability to the management interface; note that any account with report privileges remains a viable injection source, so this only reduces the attack surface rather than eliminating it. Additionally, avoid granting Proxy/report permissions to non-administrative accounts and audit GUI users for unnecessary privileges, though this is a compensating control with the trade-off of reduced operational flexibility and no protection against a compromised legitimate admin account. Because code execution is bounded to the 'nobody' user with no built-in privilege escalation, hardening that account and monitoring for unexpected child processes spawned by the CGI layer can help detect post-exploitation activity until the patch is applied.