CVE-2025-34071 GFI Kerio Control Unsigned System Image Upload Root Code Execution

Critical 9.4 Published 2 Jul 2025 Updated 26 Feb 2026

Administrators can upload unsigned firmware images to execute arbitrary code with root privileges on Kerio Control devices.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-34071?

CVE-2025-34071 is a critical vulnerability in GFI Software Kerio Control, published on 2 Jul 2025. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

A remote code execution vulnerability in GFI Kerio Control 9.4.5 allows attackers with administrative access to upload and execute arbitrary code through the firmware upgrade feature. The system upgrade mechanism accepts unsigned .img files, which can be modified to include malicious scripts within the upgrade.sh or disk image components. These modified upgrade images are not validated for authenticity or integrity, and are executed by the system post-upload, enabling root access.

Weakness: CWE-306

Which versions are affected by CVE-2025-34071?

It affects 1 product.

Products include Gfi Kerio Control.

How do I fix CVE-2025-34071?

No fix has been published for CVE-2025-34071 yet. Limit exposure of the affected software until one is available.

Is CVE-2025-34071 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-34071 exists.

Public exploit code: 1 proofs of concept on GitHub.

Sources

Also known as GHSA-p7cq-wxfh-7j76.