Cowrie Honeypot CVE-2025-34469

Requires the target to be running Cowrie honeypot prior to version 2.9.0 in its DEFAULT emulated shell mode, with the wget and curl command emulations active (default) - these emulations perform genuine outbound HTTP requests. The attacker needs only network reachability to the honeypot's SSH or Telnet service; since honeypots accept arbitrary credentials by design, no valid authentication is required (PR:N). No user interaction and no non-default configuration is needed. What LIMITS exploitation: the vulnerable software is a security honeypot (not general enterprise infrastructure), and impact is confined to availability abuse (using the honeypot as an amplification/proxy node against third parties) rather than compromise of the honeypot host, its data, or its integrity. Post-fix instances (>=2.9.0) enforce a default rate limit of 5 requests per 60-second window per host, neutralizing the amplification.

The CVSS 4.0 base score is 6.9 (Medium) with a clean network vector: AV:N/AC:L/AT:N/PR:N/UI:N and impact limited to availability (VA:L on the honeypot itself, SA:L on third-party targets). This is an abuse/amplification issue, not a compromise of the honeypot - there is no confidentiality or integrity impact (VC:N/VI:N/SC:N/SI:N), which is why the score stays Medium despite being remote and unauthenticated. Exploitation signals are elevated: a public PoC exists (referenced in the GHSA advisory and NVD), and the GHSA advisory explicitly states the vulnerability 'was observed being actively exploited in the wild.' However, this CVE is NOT in CISA KEV and no EPSS score is provided in the input, so per precision rules the vendor's in-the-wild claim cannot be upgraded to 'confirmed actively exploited (CISA KEV)' - treat it as a credible vendor observation pending independent confirmation. No SSVC decision data is provided. Net assessment: real-world risk is moderate and asymmetric - the operator running Cowrie is not directly harmed in terms of data, but their honeypot IP becomes an unwitting DDoS amplifier/proxy against arbitrary third parties, creating abuse-desk, reputation, and potential legal-attribution exposure. Given the default-configuration trigger, low complexity, no auth requirement, public PoC, and vendor ITW claim, this warrants prompt patching for anyone operating internet-facing Cowrie instances, even though the raw CVSS is only Medium.

An attacker connects to an internet-facing Cowrie honeypot over SSH or Telnet (which accepts arbitrary credentials by design) and issues a batch of concatenated 'wget'/'curl' commands pointing at a chosen victim host. Because the emulated commands perform real outbound HTTP requests with no rate limiting, the attacker loops this to generate high-volume traffic that originates from the honeypot's IP, using it as a DDoS amplification/proxy node that masks their true source. A rudimentary public PoC (100 concatenated wget calls looped over multiple SSH sessions) is published in the GHSA advisory.