Dashboard / CVE-2025-34070

CVE-2025-34070

CRITICAL
INFO Priority: 0.08 BB Relevance: 80/100
Published: 2025-07-02 Modified: 2026-11-03 First seen: 2026-11-03 Status: active

Attack Surface

Network Low Complexity No Auth No Interaction Conf. Impact Integ. Impact

CVSS Vector Breakdown

AV: Network
AC: Low
PR: None
UI: None
AT: None
VC: High
VI: High
VA: High

Description

A missing authentication vulnerability in the GFIAgent component of GFI Kerio Control 9.4.5 allows unauthenticated remote attackers to perform privileged operations. The GFIAgent service, responsible for integration with GFI AppManager, exposes HTTP services on ports 7995 and 7996 without proper authentication. The /proxy handler on port 7996 allows arbitrary forwarding to administrative endpoints when provided with an Appliance UUID, which itself can be retrieved from port 7995. This results in a complete authentication bypass, permitting access to sensitive administrative APIs.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
GFI Software Kerio Control 9.4.5

References & Advisories (2)

Bug Bounty Relevance

80 / 100
✓ Network accessible
✓ No authentication
✓ Low complexity
✓ No user interaction

CVSS Score

10.0 / 10.0 v4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

EPSS — Exploitation Probability

0.76%
Raw Score 0.007600
Percentile 55.5%
Date 2026-11-08

EPSS Trend

2026-11-08
0.00760
2026-11-07
0.00760
2026-11-06
0.00760
2026-11-05
0.00760
2026-11-04
0.00760
2026-11-03
0.00760

Intelligence Sources

mitre ref →

External Links