PT-2025-29556

CVE-2025-34115

Published

2025-07-15

Updated

2026-09-15

Description by

CVSS 4.0

8.7

High

MetricsAV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions OP5 Monitor versions through 7.1.9

Description An authenticated command injection vulnerability exists in OP5 Monitor. A user with access to the web interface can exploit the 'Test this command' feature to execute arbitrary shell commands as the unprivileged web application user. The vulnerability resides in the configuration section of the application and requires valid login credentials with access to the command testing functionality. The vulnerable parameter is cmd str in the /command test.php endpoint.

Recommendations Update to version 7.2.0 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Hyp3Rlinx

Vendors

Affected products

Weakness enumeration

CWE-20: Improper Input Validation

CWE-78: Improper Neutralization of Special Elements used in an OS Command (\'OS Command Injection\')