CVE-2025-34112
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · uneditedAn authenticated multi-stage remote code execution vulnerability exists in Riverbed SteelCentral NetProfiler and NetExpress 10.8.7 virtual appliances. A SQL injection vulnerability in the '/api/common/1.0/login' endpoint can be exploited to create a new user account in the appliance database. This user can then trigger a command injection vulnerability in the '/index.php?page=licenses' endpoint to execute arbitrary commands. The attacker may escalate privileges to root by exploiting an insecure sudoers configuration that allows the 'mazu' user to execute arbitrary commands as root via SSH key extraction and command chaining. Successful exploitation allows full remote root access to the virtual appliance.
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · high confidenceAuthenticated multi-stage RCE in Riverbed SteelCentral NetProfiler/NetExpress 10.8.7 virtual appliances. An attacker first exploits a SQL injection vulnerability in /api/common/1.0/login to create a privileged database user, then triggers command injection via the /index.php?page=licenses endpoint to execute arbitrary OS commands. Finally, an insecure sudoers configuration allows the 'mazu' user to escalate to root through SSH key extraction and command chaining, achieving full remote root access.
Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.
CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector- Attack vector
- Network
- Complexity
- Low
- Privileges
- None
- Authentication
- X
- User interaction
- None
- Scope
- X
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.
dbcve checksWork through these to decide whether this CVE applies to you.
-
Identify product and versionLocate the installed version of Riverbed SteelCentral NetProfiler or NetExpress in the appliance admin interface or system information pageAffected if The installed version matches 10.8.7 or falls within an unpatched version range for this release
-
Verify web interface exposureConfirm whether the appliance's web management interface (ports 80/443) is accessible from untrusted networksAffected if The /api/common/1.0/login and /index.php?page=licenses endpoints are reachable from outside the trusted network
-
Check for mazu user existenceQuery the system for the presence of a user account named 'mazu' (e.g., via /etc/passwd lookup or user enumeration)Affected if The 'mazu' user account exists on the system, indicating potential exposure to the privilege escalation vector
-
Inspect sudoers configuration for mazuExamine the sudoers file (typically /etc/sudoers or in /etc/sudoers.d/) for rules granting the mazu user elevated privilegesAffected if The mazu user has sudo permissions that permit command execution beyond intended boundaries or lack proper security restrictions
-
Review authentication logs for SQL injection patternsSearch web server and authentication logs for suspicious requests to /api/common/1.0/login containing SQL injection payloads or unusual query patternsAffected if Log evidence shows SQL injection attempts or creation of unexpected privileged database users
-
Audit system for unauthorized root accessReview system logs, SSH authorized_keys, and historical command execution records for signs of root-level commands initiated by the mazu userAffected if Evidence exists of root-level command execution that did not originate from authorized administrative sessions
A defender is affected if they run Riverbed SteelCentral NetProfiler or NetExpress version 10.8.7 with the web interface exposed and the mazu user present with insecure sudo privileges.
Generated from the published advisory. Verify against your own configuration.
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
dbcve · scopedApply vendor patch for version 10.8.7 or upgrade to a supported version. As immediate mitigation, restrict network access to the appliance management interfaces and implement WAF rules to block SQL injection and command injection patterns on the affected endpoints.
Latest available Riverbed SteelCentral NetProfiler/NetExpress virtual appliance version (contact support.riverbed.com for exact version)
- 1. Verify the current installed version of Riverbed SteelCentral NetProfiler or NetExpress by running: dmcli -e show system version or checking the appliance management console
- 2. Identify the latest available version from Riverbed's official support channels at support.riverbed.com
- 3. Download the latest SteelCentral NetProfiler/NetExpress virtual appliance image from the Riverbed support portal
- 4. Back up all critical configuration data and export any necessary data from the current appliance
- 5. Deploy the new virtual appliance following Riverbed's standard deployment documentation
- 6. Restore configuration from backup and verify all services are operational
- 7. Confirm the SQL injection vulnerability in /api/common/1.0/login is no longer present
- 8. Confirm the command injection in /index.php?page=licenses is no longer present
Generated from the published advisory — verify against the referenced sources before acting.
- Consultation8.0 h
- Implementation16.0 h
- Testing12.0 h
- Review / QA8.0 h
An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $12,352.
Scan for this in your stack
Free · runs locallyCheck whether your project pulls in CVE-2025-34112 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Primary sourcesPractitioner notes
ContributedPeer-ranked notes from engineers who’ve handled CVE-2025-34112 in production — separate from our analysis above.
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
- The version that genuinely resolved it — not the one the vendor claimed
- A config change or rule that shut the vector down
- A gotcha in the upgrade path that cost you an afternoon
No notes yet
Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
- Verified mitigations, workarounds, and config changes
- Version or environment caveats, and links to real fixes
- No weaponised exploit code, or anything meant to cause harm
- No spam, self-promotion, credentials, or personal data