CVE-2025-34115

Description

An authenticated command injection vulnerability exists in OP5 Monitor through version 7.1.9 via the 'cmd_str' parameter in the command_test.php endpoint. A user with access to the web interface can exploit the 'Test this command' feature to execute arbitrary shell commands as the unprivileged web application user. The vulnerability resides in the configuration section of the application and requires valid login credentials with access to the command testing functionality. This issue is fixed in version 7.2.0.

PUBLISHED Reserved 2025-04-15 | Published 2025-07-15 | Updated 2026-05-15 | Assigner VulnCheck

Problem types

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CWE-306 Missing Authentication for Critical Function

CWE-20 Improper Input Validation

Product status

Credits

hyp3rlinx finder

References

raw.githubusercontent.com/...s/linux/http/op5_config_exec.rb exploit

www.exploit-db.com/exploits/39676 exploit

www.itrsgroup.com/products/network-monitoring-op5-monitor product

www.vulncheck.com/...monitor-authenticated-command-execution third-party-advisory

cve.org (CVE-2025-34115)

nvd.nist.gov (CVE-2025-34115)

Download JSON