ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode
Full Disclosurepublished ()ingested
Part of a story covered by 2 sources: “0day Rubbish Research Team discloses two CVSS 8.8 command injection flaws: QuantaStor 6.8.3.018 alert-mail smtpPassword injection and persistent OP5 Monitor 9.20 injection despite…” — merged summary and timeline →

[0day-rubbish] OP5 Monitor 9.20 Command injection surviving the CVE-2025-34115 patch (OPT-IN fix ineffective) (8.8)

mediumVulnerabilityimportance 45CVE-2025-34115
AI summary · glm-5.3-flash

OP5 Monitor 9.20 remains vulnerable to CVSS 8.8 command injection because the CVE-2025-34115 fix is opt-in and ineffective.

0day Rubbish Research Team disclosed a command injection (CWE-78) in OP5 Monitor 9.20 that survives the existing CVE-2025-34115 patch, which is opt-in and described as ineffective. The issue scores CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Administrators who previously applied the vendor fix may still be exposed.

  • Command injection (CWE-78) persists in OP5 Monitor 9.20 after the CVE-2025-34115 patch
  • The vendor's fix is opt-in and deemed ineffective by the researchers
  • CVSS 8.8 network vector requiring low privileges
Read the original
Tagsop5-monitorcommand-injectioncwe-78patch-bypassmonitoring

Vulnerabilities mentionedAll →

CVEVulnerabilityCVSSEPSSFlagsAffectedExposurePublished
CVE-2025-34115
An authenticated command injection vulnerability exists in OP5 Monitor through version 7.1.9 via the 'cmd_str' parameter in the command_test.php endpoint.

An authenticated command injection vulnerability exists in OP5 Monitor through version 7.1.9 via the 'cmd_str' parameter in the command_test.php endpoint. A user with access to the web interface can exploit the 'Test this command' feature to execute arbitrary shell commands as the unprivileged web application user. The vulnerability resides in the configuration section of the application and requires valid login credentials with access to the command testing functionality. This issue is fixed in version 7.2.0.

NVD description · AI analysis pending		8.73%——
Full article

Posted by disclosure via Fulldisclosure on Sep 08 TO: fulldisclosure () seclists org SUBJECT: [0day-rubbish] OP5 Monitor 9.20 Command injection surviving the CVE-2025-34115 patch (OPT-IN fix ineffective) (8.8) FROM: disclosure () 0day-rubbish com ----BODY---- 0day Rubbish Research Team is publicly disclosing a vulnerability in OP5 Monitor 9.20. Type: Command injection surviving the CVE-2025-34115 patch (OPT-IN fix ineffective) (CWE-78) CVSS: 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Impact:...

This source does not provide full text. Read it at seclists.org.