CVE-2025-54767
BaseFortify
Publication date: 2025-07-29
Last updated on: 2025-11-03
Assigner: KoreLogic
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| xorux | lpar2rrd | to 8.04 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-648 | The product does not conform to the API requirements for a function call that requires extra privileges. This could allow attackers to gain privileges by causing the function to be called incorrectly. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability allows an authenticated user with read-only access to the Xormon Original virtual appliance to kill any processes running as the lpar2rrd user. It occurs because a web application endpoint improperly allows execution of a kill command on specified process IDs via a URL parameter. This can terminate critical processes such as the webserver or daemon, causing service disruption. [1]
How can this vulnerability impact me? :
The vulnerability can lead to a denial of service (DoS) by allowing an authenticated read-only user to terminate critical processes running on the appliance. This can disrupt services provided by the Xormon Original virtual appliance, potentially causing downtime and loss of availability. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by attempting to use the vulnerable web application endpoint to kill a process. For example, using a curl command with basic authentication to send a request to `/lpar2rrd-cgi/reporter.sh` with the parameter `cmd=stop` and a target process ID (PID) can demonstrate if the process can be terminated. A sample command is: `curl -u <username>:<password> 'http://<target>/lpar2rrd-cgi/reporter.sh?cmd=stop&pid=<PID>'`. If the process is killed, the system is vulnerable. [1]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to upgrade the LPAR2RRD product to version 8.05 or later, as this version addresses the vulnerability. Additionally, restrict access to the vulnerable endpoint and monitor for unauthorized use until the upgrade can be applied. [1]