VULNERABILITY INTELLIGENCE
CVE-2025-34044
EPSS probability3.95%
CISA KEVNot currently listed
Published2025-06-26
Last modified2026-06-17
Description
A remote command injection vulnerability exists in the confirm.php interface of the WIFISKY 7-layer Flow Control Router via a specially-crafted HTTP GET request to the t parameter. Insufficient input validation allows unauthenticated attackers to execute arbitrary OS commands. Exploitation evidence was observed by the Shadowserver Foundation on 2025-01-25 UTC.
Weakness classification
- disclosure@vulncheck.com: CWE-78