CVE-2025-34033

An OS command injection vulnerability exists in the Blue Angel Software Suite running on embedded Linux devices via the ping_addr parameter in the webctrl.cgi script. The application fails to properly sanitize input before passing it to the system-level ping command. An authenticated attacker can inject arbitrary commands by appending shell metacharacters to the ping_addr parameter in a crafted GET request to /cgi-bin/webctrl.cgi?action=pingtest_update. The command's output is reflected in the application's web interface, enabling attackers to view results directly. Default and backdoor credentials can be used to access the interface and exploit the issue. Successful exploitation results in arbitrary command execution as the root user. Exploitation evidence was observed by the Shadowserver Foundation on 2025-01-26 UTC.

• CWE-78
• CWE-78

• https://vulncheck.com/advisories/5vtechnologies-blue-angel-command-injectionThird Party Advisory
• https://www.exploit-db.com/exploits/46792Exploit, Third Party Advisory
• https://www.exploit-db.com/raw/46792Exploit, Third Party Advisory

Published

Jun 24, 2025

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-34028The Commvault Command Center Innovation Release allows an un…10
• CVE-2025-34029An OS command injection vulnerability exists in the Edimax E…8.8
• CVE-2025-3403A vulnerability was found in Vivotek NVR ND8422P, NVR ND9525…5.1
• CVE-2025-34030An OS command injection vulnerability exists in sar2html ver…10
• CVE-2025-34031A path traversal vulnerability exists in the Moodle LMS Jmol…7.5
• CVE-2025-34032A reflected cross-site scripting (XSS) vulnerability exists …6.1
• CVE-2025-34034A hardcoded credential vulnerability exists in the Blue Ange…8.8
• CVE-2025-34035An OS command injection vulnerability exists in EnGenius EnS…9.8
• CVE-2025-34036An OS command injection vulnerability exists in white-labele…9.8
• CVE-2025-34037An OS command injection vulnerability exists in various mode…10
• CVE-2025-34038A SQL injection vulnerability exists in Weaver E-cology 8.0 …7.5
• CVE-2025-34039A code injection vulnerability exists in Yonyou UFIDA NC v6.…10