CVE-2025-34033

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-34033
An OS command injection vulnerability exists in the Blue Angel Software Suite running on embedded Linux devices via the ping_addr parameter in the webctrl.cgi script. The application fails to properly sanitize input before passing it to the system-level ping command. An authenticated attacker can inject arbitrary commands by appending shell metacharacters to the ping_addr parameter in a crafted GET request to /cgi-bin/webctrl.cgi?action=pingtest_update. The command's output is reflected in the application's web interface, enabling attackers to view results directly. Default and backdoor credentials can be used to access the interface and exploit the issue. Successful exploitation results in arbitrary command execution as the root user.

8.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://vulncheck.com/advisories/5vtechnologies-blue-angel-command-injection Third Party Advisory
https://www.exploit-db.com/exploits/46792 Exploit Third Party Advisory
https://www.exploit-db.com/raw/46792 Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:5vtechnologies:blue_angel_software_suite:*:*:*:*:*:*:*:*
History

09 Jul 2025, 19:09

Type Values Removed Values Added
References () https://vulncheck.com/advisories/5vtechnologies-blue-angel-command-injection - () https://vulncheck.com/advisories/5vtechnologies-blue-angel-command-injection - Third Party Advisory
References () https://www.exploit-db.com/exploits/46792 - () https://www.exploit-db.com/exploits/46792 - Exploit, Third Party Advisory
References () https://www.exploit-db.com/raw/46792 - () https://www.exploit-db.com/raw/46792 - Exploit, Third Party Advisory
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 8.8
CPE cpe:2.3:a:5vtechnologies:blue_angel_software_suite:*:*:*:*:*:*:*:*
First Time 5vtechnologies
5vtechnologies blue Angel Software Suite

26 Jun 2025, 18:58

Type Values Removed Values Added
Summary
  • (es) Existe una vulnerabilidad de inyección de comandos del sistema operativo en Blue Angel Software Suite, que se ejecuta en dispositivos Linux integrados, mediante el parámetro ping_addr del script webctrl.cgi. La aplicación no depura correctamente la entrada antes de pasarla al comando ping a nivel de sistema. Un atacante autenticado puede inyectar comandos arbitrarios añadiendo metacaracteres de shell al parámetro ping_addr en una solicitud GET manipulada a /cgi-bin/webctrl.cgi?action=pingtest_update. La salida del comando se refleja en la interfaz web de la aplicación, lo que permite a los atacantes ver los resultados directamente. Se pueden usar credenciales predeterminadas y de puerta trasera para acceder a la interfaz y explotar el problema. Una explotación exitosa resulta en la ejecución de comandos arbitrarios como usuario root.

24 Jun 2025, 22:15

Type Values Removed Values Added
References
  • () https://www.exploit-db.com/raw/46792 -

24 Jun 2025, 03:15

Type Values Removed Values Added
References
  • {'url': 'https://vulncheck.com/advisories/blue-angel-software-suite-command-injection-default-credentials', 'source': 'disclosure@vulncheck.com'}
  • () https://vulncheck.com/advisories/5vtechnologies-blue-angel-command-injection -

24 Jun 2025, 01:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-06-24 01:15

Updated : 2025-07-09 19:09

NVD link : CVE-2025-34033

Mitre link : CVE-2025-34033

CVE.ORG link : CVE-2025-34033

JSON object : View

Products Affected

5vtechnologies

  • blue_angel_software_suite
CWE
CWE-20

Improper Input Validation

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')