CVE-2025-34071

The system update mechanism accepts .img files without verifying the digital signature or integrity. An attacker with administrator privileges can upload a modified update image containing malicious scripts placed in the upgrade.sh component or in the disk image. After uploading such a file, the system automatically executes it without any authenticity checks, resulting in malicious code execution with root privileges.

An attacker can gain full root access to the system, enabling device takeover, modification of its configuration, interception of network traffic, or use of the device as an entry point to the internal network.

Apply patches available from the vendor according to the references. Additionally, it is recommended to restrict access to the administrative interface only to trusted hosts and verify that the administrative console is not accessible from the Internet.

GFI Kerio Control version 9.4.5