by Kastro
Paper/Archive/CVE-2025-34071

CVE-2025-34071

GFI Software Kerio Control — GFI Kerio Control Unsigned System Image Upload Root Code Execution

EPSS 0.8%public exploitCVSS 9.8
critical.is priorityof 100
51
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 57.0.570 × 2011.4Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

A remote code execution vulnerability in GFI Kerio Control 9.4.5 allows attackers with administrative access to upload and execute arbitrary code through the firmware upgrade feature. The system upgrade mechanism accepts unsigned .img files, which can be modified to include malicious scripts within the upgrade.sh or disk image components. These modified upgrade images are not validated for authenticity or integrity, and are executed by the system post-upload, enabling root access.

Affected

ProductAffectedFixed inSource
Kerio Control9.4.5–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
VulnCheck (CNA)9.4CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: total

References

exploitssd-disclosure.com/ssd-advisory-kerio-control-authentication-bypass-and-rcewriteupvulncheck.com/advisories/gfi-kerio-control-auth-bypass-rce