CVE-2025-34070 GFI Kerio Control GFIAgent Missing Authentication on Administrative Interfaces

Critical 10.0 Published 2 Jul 2025 Updated 26 Feb 2026

Unauthenticated attackers can bypass authentication to access administrative APIs and perform privileged operations on GFI Kerio Control devices.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-34070?

CVE-2025-34070 is a critical authentication bypass vulnerability in GFI Software Kerio Control, published on 2 Jul 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A missing authentication vulnerability in the GFIAgent component of GFI Kerio Control 9.4.5 allows unauthenticated remote attackers to perform privileged operations. The GFIAgent service, responsible for integration with GFI AppManager, exposes HTTP services on ports 7995 and 7996 without proper authentication. The /proxy handler on port 7996 allows arbitrary forwarding to administrative endpoints when provided with an Appliance UUID, which itself can be retrieved from port 7995. This results in a complete authentication bypass, permitting access to sensitive administrative APIs.

Weakness: CWE-306

Which versions are affected by CVE-2025-34070?

It affects 1 product.

Products include Gfi Kerio Control.

How do I fix CVE-2025-34070?

No fix has been published for CVE-2025-34070 yet. Limit exposure of the affected software until one is available.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2025-34070 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-34070 exists.

Sources

Also known as GHSA-gxh5-69f2-j43w.