CVE-2025-34071: GFI Kerio Control Unsigned System Image Upload Root Code Execution
A remote code execution vulnerability in GFI Kerio Control 9.4.5 allows attackers with administrative access to upload and execute arbitrary code through the firmware upgrade feature. The system upgrade mechanism accepts unsigned .img files, which can be modified to include malicious scripts within the upgrade.sh or disk image components. These modified upgrade images are not validated for authenticity or integrity, and are executed by the system post-upload, enabling root access.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-34071?
CVE-2025-34071 is rated as a critical vulnerability due to its potential for remote code execution.
How do I fix CVE-2025-34071?
To fix CVE-2025-34071, update GFI Kerio Control to the latest version that addresses this vulnerability.
Who is affected by CVE-2025-34071?
GFI Kerio Control users, specifically those running version 9.4.5 or older, are affected by CVE-2025-34071.
What type of vulnerability is CVE-2025-34071?
CVE-2025-34071 is a remote code execution vulnerability that allows unauthorized code execution.
What is the cause of CVE-2025-34071?
CVE-2025-34071 is caused by the acceptance of unsigned .img files in the firmware upgrade process.