{"id":"CVE-2025-34312","title":"IPFire versions prior to 2.29 (Core Update 198) contain a command injection vulnerability that allows an authenticated attacker to execute arbitrary commands as the 'nobody' user via the BE_NAME parameter when installing a blacklist","summary":"IPFire versions prior to 2.29 (Core Update 198) contain a command injection vulnerability that allows an authenticated attacker to execute arbitrary commands as the 'nobody' user via the BE_NAME parameter when installing a blacklist. Whe…","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-78"],"vendor":"ipfire","product":"ipfire","affected":["ipfire < 2.29","ipfire = 2.29"],"patched":["ipfire 2.29"],"published":"2025-10-28","updated":"2026-09-26","sourceUpdated":"2026-09-26T00:10:00.127","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-34312","references":[{"url":"https://bugzilla.ipfire.org/show_bug.cgi?id=13887","label":"disclosure@vulncheck.com"},{"url":"https://www.ipfire.org/blog/ipfire-2-29-core-update-198-released","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/ipfire-command-injection-via-url-filter-blacklist","label":"disclosure@vulncheck.com"}],"tags":["nvd"],"epss":0.02296,"epssPercentile":0.8255,"ingestedAt":"2026-09-26T00:22:39.964Z","slug":"CVE-2025-34312","body":"## Overview\n\nIPFire versions prior to 2.29 (Core Update 198) contain a command injection vulnerability that allows an authenticated attacker to execute arbitrary commands as the 'nobody' user via the BE_NAME parameter when installing a blacklist. When a blacklist is installed the application issues an HTTP POST to /cgi-bin/urlfilter.cgi and interpolates the value of BE_NAME directly into a shell invocation without appropriate sanitation. Crafted input can inject shell metacharacters, leading to arbitrary command execution in the context of the 'nobody' user.\n\n## Affected\n\n- `ipfire < 2.29`\n- `ipfire = 2.29`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `ipfire 2.29`","depth":"twilight","depthScore":49,"depthScoreParts":{"impact":48.4,"likelihood":0.5,"exploitation":0,"ransomware":0},"changes":[]}