CVE-2025-34033 is an OS command injection vulnerability in the Blue Angel Software Suite, specifically affecting embedded Linux devices. An authenticated attacker can execute arbitrary commands as root by injecting shell metacharacters into the ping_addr parameter of the webctrl.cgi script. This vulnerability carries a high CVSS score of 8.8, indicating a network-based attack with low complexity and high impact on confidentiality, integrity, and availability. Exploitation evidence was observed on January 26, 2025, by the Shadowserver Foundation, but no public exploit code or significant community discussion has been identified.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
All Versions ImpactedCPE matchmatch criteria | cpe:2.3:a:5vtechnologies:blue_angel_software_suite:*:*:*:*:*:*:*:* |
CVSS version used by this source: 4.0
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.3 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.