Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.7

Blue Angel Software Suite: Unauthenticated Root Access via Ping Request

CVE-2025-34033 · published 1 year ago
Summary

The Blue Angel Software Suite on some Linux devices has a security flaw that allows attackers to gain full access to the device as the administrator. This is because the software doesn't properly check user input, which can be exploited by sending a specially crafted request to the software's web interface. To protect your device, update the software to the latest version available, and make sure to use strong, unique passwords for the default and backdoor accounts.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
5vtechnologies blue_angel_software_suite All versions
cpe:2.3:a:5vtechnologies:blue_angel_software_suite:*:*:*:*:*:*:*:*
Original advisory text
An OS command injection vulnerability exists in the Blue Angel Software Suite running on embedded Linux devices via the ping_addr parameter in the webctrl.cgi script. The application fails to prope...
An OS command injection vulnerability exists in the Blue Angel Software Suite running on embedded Linux devices via the ping_addr parameter in the webctrl.cgi script. The application fails to properly sanitize input before passing it to the system-level ping command. An authenticated attacker can inject arbitrary commands by appending shell metacharacters to the ping_addr parameter in a crafted GET request to /cgi-bin/webctrl.cgi?action=pingtest_update. The command's output is reflected in the application's web interface, enabling attackers to view results directly. Default and backdoor credentials can be used to access the interface and exploit the issue. Successful exploitation results in arbitrary command execution as the root user. Exploitation evidence was observed by the Shadowserver Foundation on 2025-01-26 UTC.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
7.7 High
Exploitation
13% chance of attack within 30 days
Type
CWE-78OS Command Injection
Timeline
Published24 Jun 2025
Updated4 Nov 2026
First seen7 Mar 2026
Sources
CVE-2025-34033 · NVD
Track software like this
Free during beta