Ipfire
Monthly
lfs/backup in IPFire 2.25-core155 does not ensure that /var/ipfire/backup/bin/backup.pl is owned by the root account. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
IPFire 2.19 has a Remote Command Injection vulnerability in ids.cgi via the OINKCODE parameter, which is mishandled by a shell. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 77.9%.
IPFire 2.21 Core Update 127 contains multiple reflected cross-site scripting vulnerabilities in the fwhosts.cgi script that allow attackers to inject malicious scripts through multiple parameters including HOSTNAME, IP, SUBNET, NETREMARK, HOSTREMARK, newhost, grp_name, remark, SRV_NAME, SRV_PORT, SRVGRP_NAME, SRVGRP_REMARK, and updatesrvgrp. [CVSS 5.4 MEDIUM]
IPFire 2.21 Core Update 127 contains multiple stored cross-site scripting vulnerabilities in the extrahd.cgi script that allow attackers to inject malicious scripts through the FS, PATH, and UUID parameters. [CVSS 6.4 MEDIUM]
IPFire 2.21 Core Update 127 contains multiple cross-site scripting vulnerabilities in the ovpnmain.cgi script that allow attackers to inject malicious scripts through VPN configuration parameters. [CVSS 6.1 MEDIUM]
IPFire 2.21 Core Update 127 contains multiple reflected cross-site scripting vulnerabilities in the hosts.cgi script that allow attackers to inject malicious scripts through unvalidated parameters. [CVSS 6.1 MEDIUM]
IPFire 2.21 Core Update 127 contains a reflected cross-site scripting vulnerability in the updatexlrator.cgi script that allows attackers to inject malicious scripts through POST parameters. [CVSS 6.1 MEDIUM]
Stored cross-site scripting in the IPFire firewall distribution (versions before 2.29 Core Update 198) lets an authenticated administrator inject arbitrary JavaScript through the txt_mailuser and txt_mailpass fields of the mail-server settings form, which is posted to /cgi-bin/mail.cgi. Because those values are persisted and later rendered in the web UI without sanitisation or encoding, the script executes in the browser session of any other user who opens the affected mail configuration page, enabling session theft or privileged actions in that user's context. Authentication is required (CVSS 4.0 vector shows PR:L) and the victim must view the page (UI:P), so exploitation is a two-party, low-privilege-to-privileged chain; EPSS is 0.45% (37th percentile), no public exploit code is known, and the issue is fixed in Core Update 198.
Stored cross-site scripting in IPFire (all releases prior to 2.29 Core Update 198) allows an authenticated user with access to the Remote Logging settings to inject arbitrary JavaScript through the REMOTELOG_ADDR parameter of the POST to /cgi-bin/logs.cgi/config.dat; the value is persisted and later rendered in the Syslog configuration page without encoding, so the script executes in the browser of any user who views it. Exploitation requires a prior authenticated session (CVSS vector PR:L), access to that specific admin settings page, and a second user subsequently opening the affected page (UI:P), which is why the independent assessment treats this as a genuine but low-severity, high-noise finding rather than an urgent priority. No public exploit code was identified at time of analysis and EPSS is low at 0.45% (37th percentile); the issue is not in CISA KEV. Vendor-released patch: IPFire 2.29 Core Update 198.
Command injection in the IPFire URL filter allows an authenticated administrator to execute arbitrary shell commands as the unprivileged 'nobody' user by supplying a crafted BE_NAME value when installing a blacklist through the web interface. The flaw affects IPFire releases prior to 2.29 Core Update 198, and exploitation requires a valid GUI session (CVSS PR:L) plus the ability to trigger a blacklist installation, so unauthenticated remote attackers cannot reach the vulnerable code path; no public exploit code was identified at time of analysis, and the resulting command execution is confined to the 'nobody' account rather than root. With a CVSS 4.0 base score of 8.7 (assessed equivalently as CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), this is a genuine but credential-gated priority for firewall appliances whose management interface is reachable by untrusted users.
Authenticated command injection in the IPFire firewall distribution prior to 2.29 (Core Update 198) lets a low-privilege WebGUI user run arbitrary shell commands as the 'nobody' service account. When a Proxy (Calamaris) report is generated, the GUI POSTs to /cgi-bin/logs.cgi/calamaris.dat and passes fields such as DAY_BEGIN, MONTH_BEGIN, YEAR_BEGIN, NUM_DOMAINS and BYTE_UNIT straight into the mkreport helper without sanitization, so shell metacharacters in any of those fields are executed server-side. The issue is remotely reachable but requires valid GUI credentials and access to the firewall's management interface; there is no public exploit identified at time of analysis and no CISA KEV listing, though the assessed CVSS:3.1 vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H and the reported CVSS 8.7 reflect high confidentiality, integrity and availability impact within the compromised 'nobody' context.
IPFire 2.29 web-based firewall interface (firewall.cgi) fails to sanitize several rule parameters such as PROT, SRC_PORT, TGT_PORT, dnatport, key, ruleremark, src_addr, std_net_tgt, and tgt_addr,. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
IPFire 2.29 DNS management interface (dns.cgi) fails to properly sanitize user-supplied input in the NAMESERVER, REMARK, and TLS_HOSTNAME query parameters, resulting in a reflected cross-site. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The Calamaris log exporter CGI (/cgi-bin/logs.cgi/calamaris.dat) in IPFire 2.29 does not properly sanitize user-supplied input before incorporating parameter values into a shell command. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Multiple stored cross-site scripting vulnerabilities in the web user interface of IPFire versions prior to 2.27 allows a remote authenticated attacker with administrative privilege to inject an. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An authenticated command injection vulnerability exists in IPFire Firewall before 2.21 Core Update 124 in backup.cgi. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
lfs/backup in IPFire 2.25-core155 does not ensure that /var/ipfire/backup/bin/backup.pl is owned by the root account. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
IPFire 2.19 has a Remote Command Injection vulnerability in ids.cgi via the OINKCODE parameter, which is mishandled by a shell. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 77.9%.
IPFire 2.21 Core Update 127 contains multiple reflected cross-site scripting vulnerabilities in the fwhosts.cgi script that allow attackers to inject malicious scripts through multiple parameters including HOSTNAME, IP, SUBNET, NETREMARK, HOSTREMARK, newhost, grp_name, remark, SRV_NAME, SRV_PORT, SRVGRP_NAME, SRVGRP_REMARK, and updatesrvgrp. [CVSS 5.4 MEDIUM]
IPFire 2.21 Core Update 127 contains multiple stored cross-site scripting vulnerabilities in the extrahd.cgi script that allow attackers to inject malicious scripts through the FS, PATH, and UUID parameters. [CVSS 6.4 MEDIUM]
IPFire 2.21 Core Update 127 contains multiple cross-site scripting vulnerabilities in the ovpnmain.cgi script that allow attackers to inject malicious scripts through VPN configuration parameters. [CVSS 6.1 MEDIUM]
IPFire 2.21 Core Update 127 contains multiple reflected cross-site scripting vulnerabilities in the hosts.cgi script that allow attackers to inject malicious scripts through unvalidated parameters. [CVSS 6.1 MEDIUM]
IPFire 2.21 Core Update 127 contains a reflected cross-site scripting vulnerability in the updatexlrator.cgi script that allows attackers to inject malicious scripts through POST parameters. [CVSS 6.1 MEDIUM]
Stored cross-site scripting in the IPFire firewall distribution (versions before 2.29 Core Update 198) lets an authenticated administrator inject arbitrary JavaScript through the txt_mailuser and txt_mailpass fields of the mail-server settings form, which is posted to /cgi-bin/mail.cgi. Because those values are persisted and later rendered in the web UI without sanitisation or encoding, the script executes in the browser session of any other user who opens the affected mail configuration page, enabling session theft or privileged actions in that user's context. Authentication is required (CVSS 4.0 vector shows PR:L) and the victim must view the page (UI:P), so exploitation is a two-party, low-privilege-to-privileged chain; EPSS is 0.45% (37th percentile), no public exploit code is known, and the issue is fixed in Core Update 198.
Stored cross-site scripting in IPFire (all releases prior to 2.29 Core Update 198) allows an authenticated user with access to the Remote Logging settings to inject arbitrary JavaScript through the REMOTELOG_ADDR parameter of the POST to /cgi-bin/logs.cgi/config.dat; the value is persisted and later rendered in the Syslog configuration page without encoding, so the script executes in the browser of any user who views it. Exploitation requires a prior authenticated session (CVSS vector PR:L), access to that specific admin settings page, and a second user subsequently opening the affected page (UI:P), which is why the independent assessment treats this as a genuine but low-severity, high-noise finding rather than an urgent priority. No public exploit code was identified at time of analysis and EPSS is low at 0.45% (37th percentile); the issue is not in CISA KEV. Vendor-released patch: IPFire 2.29 Core Update 198.
Command injection in the IPFire URL filter allows an authenticated administrator to execute arbitrary shell commands as the unprivileged 'nobody' user by supplying a crafted BE_NAME value when installing a blacklist through the web interface. The flaw affects IPFire releases prior to 2.29 Core Update 198, and exploitation requires a valid GUI session (CVSS PR:L) plus the ability to trigger a blacklist installation, so unauthenticated remote attackers cannot reach the vulnerable code path; no public exploit code was identified at time of analysis, and the resulting command execution is confined to the 'nobody' account rather than root. With a CVSS 4.0 base score of 8.7 (assessed equivalently as CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), this is a genuine but credential-gated priority for firewall appliances whose management interface is reachable by untrusted users.
Authenticated command injection in the IPFire firewall distribution prior to 2.29 (Core Update 198) lets a low-privilege WebGUI user run arbitrary shell commands as the 'nobody' service account. When a Proxy (Calamaris) report is generated, the GUI POSTs to /cgi-bin/logs.cgi/calamaris.dat and passes fields such as DAY_BEGIN, MONTH_BEGIN, YEAR_BEGIN, NUM_DOMAINS and BYTE_UNIT straight into the mkreport helper without sanitization, so shell metacharacters in any of those fields are executed server-side. The issue is remotely reachable but requires valid GUI credentials and access to the firewall's management interface; there is no public exploit identified at time of analysis and no CISA KEV listing, though the assessed CVSS:3.1 vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H and the reported CVSS 8.7 reflect high confidentiality, integrity and availability impact within the compromised 'nobody' context.
IPFire 2.29 web-based firewall interface (firewall.cgi) fails to sanitize several rule parameters such as PROT, SRC_PORT, TGT_PORT, dnatport, key, ruleremark, src_addr, std_net_tgt, and tgt_addr,. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
IPFire 2.29 DNS management interface (dns.cgi) fails to properly sanitize user-supplied input in the NAMESERVER, REMARK, and TLS_HOSTNAME query parameters, resulting in a reflected cross-site. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The Calamaris log exporter CGI (/cgi-bin/logs.cgi/calamaris.dat) in IPFire 2.29 does not properly sanitize user-supplied input before incorporating parameter values into a shell command. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Multiple stored cross-site scripting vulnerabilities in the web user interface of IPFire versions prior to 2.27 allows a remote authenticated attacker with administrative privilege to inject an. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An authenticated command injection vulnerability exists in IPFire Firewall before 2.21 Core Update 124 in backup.cgi. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.