CVE-2025-34070

CRITICAL

9.8

Descricao

A missing authentication vulnerability in the GFIAgent component of GFI Kerio Control 9.4.5 allows unauthenticated remote attackers to perform privileged operations. The GFIAgent service, responsible for integration with GFI AppManager, exposes HTTP services on ports 7995 and 7996 without proper authentication. The /proxy handler on port 7996 allows arbitrary forwarding to administrative endpoints when provided with an Appliance UUID, which itself can be retrieved from port 7995. This results in a complete authentication bypass, permitting access to sensitive administrative APIs.

Detalhes CVE

Pontuacao CVSS v3.19.8

SeveridadeCRITICAL

Vetor CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Vetor de ataqueNETWORK

ComplexidadeLOW

Privilegios necessariosNONE

Interacao do usuarioNONE

Publicado7/2/2025

Ultima modificacao9/17/2025

Fontenvd

Avistamentos honeypot0

Produtos afetados

gfi:kerio_control

Fraquezas (CWE)

CWE-306

Referencias

https://ssd-disclosure.com/ssd-advisory-kerio-control-authentication-bypass-and-rce/(disclosure@vulncheck.com)

https://vulncheck.com/advisories/gfi-kerio-control-auth-bypass-rce(disclosure@vulncheck.com)

Correlacoes IOC

Sem correlacoes registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.