CVE-2019-25671
Published: 05 April 2026
Description
VA MAX 8.3.4 contains a remote code execution vulnerability that allows authenticated attackers to execute arbitrary commands by injecting shell metacharacters into the mtu_eth0 parameter. Attackers can send POST requests to the changeip.php endpoint with malicious payload in the mtu_eth0…
more
field to execute commands as the apache user.
Mitigating Controls (NIST 800-53 r5)AI
Directly requires validation of the mtu_eth0 parameter to reject shell metacharacters, preventing command injection in changeip.php.
Mandates identification, reporting, and correction of the specific input validation flaw in VA MAX 8.3.4, eliminating the remote code execution vulnerability.
Boundary protection with web application firewalls monitors and blocks malicious POST requests containing shell metacharacters in the mtu_eth0 field.
Security SummaryAI
CVE-2019-25671 is a remote code execution vulnerability affecting VA MAX version 8.3.4. The flaw arises from insufficient input validation, allowing attackers to inject shell metacharacters into the mtu_eth0 parameter via POST requests to the changeip.php endpoint. This CWE-22 issue enables arbitrary command execution and carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Authenticated attackers with low privileges can exploit this vulnerability remotely with low complexity and no user interaction. By crafting a malicious payload in the mtu_eth0 field, they can execute arbitrary commands on the target system running as the apache user, potentially leading to full server compromise including data exfiltration, modification, or disruption.
Advisories document the issue, with a proof-of-concept exploit available at https://www.exploit-db.com/exploits/46348 and further details in the VulnCheck advisory at https://www.vulncheck.com/advisories/va-max-remote-code-execution-via-changeip-php.
Details
- CWE(s)
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE-2019-25671 enables remote code execution through command injection (shell metacharacters) in a public-facing web endpoint (changeip.php), directly facilitating T1190 (Exploit Public-Facing Application) and T1059.004 (Unix Shell) as an authenticated low-privilege attacker.