Which versions of IPFire are affected by CVE-2025-34312?

IPFire firewall appliances running versions prior to 2.29 Core Update 198 are affected by a high-severity command injection vulnerability.

How to fix or mitigate CVE-2025-34312?

Within 24 hours, inventory all IPFire deployments and verify if any are running versions prior to 2.29 Core Update 198; restrict web interface access to trusted management networks only, enforce strong authentication for all admin accounts, and enable detailed logging for blacklist installation attempts. Within 7 days, conduct a thorough audit of administrative access and implement network segmentation to isolate firewall management interfaces; if multi-factor authentication is supported, enable it, and continuously monitor for suspicious activity. Within 30 days, if a vendor patch is released, test and deploy it immediately; otherwise, maintain compensating controls and evaluate whether the residual risk is acceptable, considering additional hardening or alternative solutions. No vendor-released patch identified at time of analysis, and no public exploit identified at time of analysis.

IPFire CVE-2025-34312

Q: What is the CVSS score of CVE-2025-34312?

CVE-2025-34312 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 2.3%.

HIGH

OS Command Injection (CWE-78)

2025-10-28 disclosure@vulncheck.com

Command Injection Ipfire

8.7

CVSS 4.0 · Vendor: vulncheck

Severity by source

Vendor (vulncheck) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Network-reachable web GUI with low-privilege authentication required (PR:L); command injection yields full C/I/A in the 'nobody' process context with no scope change (S:U).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (vulncheck).

CVSS VectorVendor: vulncheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Sep 26, 2026 - 00:31 vuln.today

CVE Published

Oct 28, 2025 - 15:16 cve.org

HIGH 8.7

DescriptionCVE.org

IPFire versions prior to 2.29 (Core Update 198) contain a command injection vulnerability that allows an authenticated attacker to execute arbitrary commands as the 'nobody' user via the BE_NAME parameter when installing a blacklist. When a blacklist is installed the application issues an HTTP POST to /cgi-bin/urlfilter.cgi and interpolates the value of BE_NAME directly into a shell invocation without appropriate sanitation. Crafted input can inject shell metacharacters, leading to arbitrary command execution in the context of the 'nobody' user.

AnalysisAI

Command injection in the IPFire URL filter allows an authenticated administrator to execute arbitrary shell commands as the unprivileged 'nobody' user by supplying a crafted BE_NAME value when installing a blacklist through the web interface. The flaw affects IPFire releases prior to 2.29 Core Update 198, and exploitation requires a valid GUI session (CVSS PR:L) plus the ability to trigger a blacklist installation, so unauthenticated remote attackers cannot reach the vulnerable code path; no public exploit code was identified at time of analysis, and the resulting command execution is confined to the 'nobody' account rather than root. With a CVSS 4.0 base score of 8.7 (assessed equivalently as CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), this is a genuine but credential-gated priority for firewall appliances whose management interface is reachable by untrusted users.

Technical ContextAI

The issue is an OS command injection (CWE-78) in IPFire's URL filter component. When an administrator installs or updates a URL-filter blacklist, the web front end issues an HTTP POST to /cgi-bin/urlfilter.cgi, a CGI handler that shells out to system utilities to fetch, unpack and register the blacklist. The BE_NAME parameter, which identifies the blacklist being installed, is interpolated directly into that shell invocation without sanitisation or argument quoting, so shell metacharacters supplied by the caller are interpreted by the shell rather than treated as data. Because the CGI runs under the low-privileged 'nobody' account used by the IPFire web server for CGI execution, injected commands inherit that identity, limiting direct privilege but still allowing arbitrary reads/writes within nobody's permissions, credential or configuration harvesting, and network access from the firewall host. The CPE data enumerates IPFire 2.29 across Core Update 183 through 191 (cpe:2.3:a:ipfire:ipfire:2.29:core_update183 ... core_update191) plus a wildcard entry cpe:2.3:a:ipfire:ipfire:*, confirming the vulnerable surface is the legacy 2.29 core-update line prior to Core Update 198. No additional memory-safety, deserialisation or cryptographic weakness is involved: the entire root cause is unsafe passing of user-controlled input to a shell.

RemediationAI

Upgrade to IPFire 2.29 Core Update 198 or later: this is the vendor-released patch, announced at https://www.ipfire.org/blog/ipfire-2-29-core-update-198-released and tracked in the upstream bug at https://bugzilla.ipfire.org/show_bug.cgi?id=13887 (independent analysis: https://www.vulncheck.com/advisories/ipfire-command-injection-via-url-filter-blacklist); upgrades are applied through the IPFire package manager or the web UI's update function and should be followed by a reboot. Because exploitation is gated on an authenticated GUI session, the most effective compensating control is to restrict access to the web administration interface (default port 444) to the trusted LAN/GREEN zone only and never expose it to the WAN or RED zone - the trade-off is that remote administration must then be tunnelled through a VPN or an SSH port-forward rather than performed directly. Administrators who cannot patch immediately should avoid installing or updating URL filter blacklists from any source until the update is applied, accepting reduced URL-filtering coverage as the cost, and should audit the 'nobody'-owned processes and IPFire logs for unexpected urlfilter.cgi POSTs or shell activity originating from the web interface. Given the low privilege level of the executing account, credential rotation for GUI administrators and review of exported or world-readable configuration files are worthwhile follow-ups, but none of these workarounds is a substitute for applying Core Update 198. Patch status: Vendor-released patch: IPFire 2.29 Core Update 198.