[0day-rubbish] OP5 Monitor 9.20 Command injection surviving the CVE-2025-34115 patch (OPT-IN fix ineffective) (8.8)
OP5 Monitor 9.20 remains vulnerable to CVSS 8.8 command injection because the CVE-2025-34115 fix is opt-in and ineffective.
0day Rubbish Research Team disclosed a command injection (CWE-78) in OP5 Monitor 9.20 that survives the existing CVE-2025-34115 patch, which is opt-in and described as ineffective. The issue scores CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Administrators who previously applied the vendor fix may still be exposed.
- Command injection (CWE-78) persists in OP5 Monitor 9.20 after the CVE-2025-34115 patch
- The vendor's fix is opt-in and deemed ineffective by the researchers
- CVSS 8.8 network vector requiring low privileges
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-34115 | An authenticated command injection vulnerability exists in OP5 Monitor through version 7.1.9 via the 'cmd_str' parameter in the command_test.php endpoint | 8.7 | 3% |
From the original article
Posted by disclosure via Fulldisclosure on Sep 08 TO: fulldisclosure () seclists org SUBJECT: [0day-rubbish] OP5 Monitor 9. 20 Command injection surviving the CVE-2025-34115 patch (OPT-IN fix ineffective) (8. 8) FROM: disclosure () 0day-rubbish com ----BODY---- 0day Rubbish Research Team is publicly disclosing a vulnerability in OP5 Monitor 9.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.