FOGProject < 1.5.10.1693 - Authentication Bypass

criticalseverity

9.1CVSS score

21.3%likelihood of exploitation, next 30 days

98%of all CVEs are less likely

Readycheck to confirm it

FOGProject version 1.5.10.1673 suffers from an authentication bypass vulnerability that allows unauthenticated users to access the management interface without proper authentication. This can lead to unauthorized access to system configuration, host management, and potentially database information.

Impact

Unauthenticated attackers can bypass authentication to access the FOGProject management interface and retrieve sensitive system configuration and host management information.

Fix

Upgrade FOGProject to a version later than 1.5.10.1673 that implements proper authentication on all management endpoints.

How to confirm it

Send: GET {{BaseURL}}/fog/service/getversion.php
Positive when: status_code == 200 and regex("^1\\.[56]\\.[0-9]+(\\.[0-9]+|-[a-z]+\\.[0-9]+)?$", trim_space(body))
Send: GET {{BaseURL}}/fog/status/getfiles.php?path[]=
Positive when: status_code == 200 and trim_space(body) == '"Invalid"'

Run it with nuclei: nuclei -id CVE-2025-58443 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2025-58443

info:
  name: FOGProject < 1.5.10.1693 - Authentication Bypass
  author: oleveloper
  severity: critical
  description: |
    FOGProject version 1.5.10.1673 suffers from an authentication bypass vulnerability that allows unauthenticated users to access the management interface without proper authentication. This can lead to unauthorized access to system configuration, host management, and potentially database information.
  impact: |
    Unauthenticated attackers can bypass authentication to access the FOGProject management interface and retrieve sensitive system configuration and host management information.
  remediation: |
    Upgrade FOGProject to a version later than 1.5.10.1673 that implements proper authentication on all management endpoints.
  reference:
    - https://github.com/casp3r0x0/CVE-2025-58443
    - https://nvd.nist.gov/vuln/detail/CVE-2025-58443
    - https://github.com/FOGProject/fogproject/security/advisories/GHSA-mvwm-9m2h-87p9
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
    cvss-score: 9.1
    cve-id: CVE-2025-58443
    epss-score: 0.21291
    epss-percentile: 0.97617
    cwe-id: CWE-287
  metadata:
    max-request: 2
    vendor: fogproject
    product: fogproject
    fofa-query: icon_hash="-1952619005"
    shodan-query: http.favicon.hash:-1952619005
  tags: cve,cve2025,fogproject,auth-bypass,vkev,vuln

flow: http(1) && http(2)

http:
  - method: GET
    path:
      - "{{BaseURL}}/fog/service/getversion.php"

    matchers:
      - type: dsl
        dsl:
          - "status_code == 200"
          - 'regex("^1\\.[56]\\.[0-9]+(\\.[0-9]+|-[a-z]+\\.[0-9]+)?$", trim_space(body))'
        condition: and
        internal: true

    extractors:
      - type: regex
        name: fogversion
        internal: true
        regex:
          - '^1\.[56]\.[0-9.]+(-[a-z]+\.[0-9]+)?$'

  - method: GET
    path:
      - "{{BaseURL}}/fog/status/getfiles.php?path[]="

    headers:
      X-Requested-With: XMLHttpRequest

    matchers:
      - type: dsl
        dsl:
          - "status_code == 200"
          - "trim_space(body) == '\"Invalid\"'"
        condition: and

    extractors:
      - type: dsl
        dsl:
          - fogversion

References

Use this check only on systems you are authorised to test. Where the data comes from