Kerio Control v9.2.5 - CRLF Injection

Kerio Control, formerly known as Kerio WinRoute Firewall, has been found vulnerable to multiple HTTP Response Splitting vulnerabilities in product affecting versions 9.2.5 id: CVE-2024-52875 info: name: Kerio Control v9.2.5 - CRLF Injection author: ritikchaddha,iamnoooob,rootxharsh,pdresearch...

GFI Kerio Control 9.4.5 Unsigned Firmware Update Remote Code Execution

GFI Kerio Control version 9.4.5 accepts unsigned firmware images, allowing an authenticated attacker to execute arbitrary code as root. This proof of concept creates and uploads a modified upgrade image. https://packetstorm.news/download/235083...

Exploit for Missing Authentication for Critical Function in Gfi Kerio_Control

!WARNING DISCLAIMER This proof-of-concept is provide...

Exploit for Missing Authentication for Critical Function in Gfi Kerio_Control

!WARNING DISCLAIMER This proof-of-concept is provide...

Kerio Control v9.2.5 - CRLF Injection Detection

Kerio Control, formerly known as Kerio WinRoute Firewall, has been found vulnerable to multiple HTTP Response Splitting vulnerabilities in product affecting versions 9.2.5 !/usr/bin/env python3 -- coding: utf-8 -- """Kerio Control, formerly known as Kerio WinRoute Firewall, has been found...

CVE-2019-16414

A DOM based XSS in GFI Kerio Control v9.3.0 allows embedding of malicious code and manipulating the login page to send back a victim's cleartext credentials to an attacker via a login/?reason=failure= URI...

EUVD-2019-7156

Malware in sbrugna...

EUVD-2014-3794

Malware in sbrugna...

EUVD-2025-19721

Malicious code in bioql PyPI...

EUVD-2025-19722

Malicious code in bioql PyPI...

EUVD-2025-19720

Malicious code in bioql PyPI...

Kerio Control upgrade.sh Privilege Escalation

The vulnerability of the upgrade.sh component of the Kerio Control networking software lies in the lack of authentication for a critical function. Exploiting this vulnerability allows an attacker operating remotely to increase their privileges...

GFIAgent Network Filtering Full Access

The vulnerability of the GFIAgent software, a network filtering tool from Kerio Control, is related to the lack of authentication for a critical function. Exploiting this vulnerability allows a malicious actor, operating remotely, to gain full access to the device with administrator privileges...

CVE-2025-34070

A missing authentication vulnerability in the GFIAgent component of GFI Kerio Control 9.4.5 allows unauthenticated remote attackers to perform privileged operations. The GFIAgent service, responsible for integration with GFI AppManager, exposes HTTP services on ports 7995 and 7996 without proper...

CVE-2025-34071

A remote code execution vulnerability in GFI Kerio Control 9.4.5 allows attackers with administrative access to upload and execute arbitrary code through the firmware upgrade feature. The system upgrade mechanism accepts unsigned .img files, which can be modified to include malicious scripts with...

CVE-2025-34069

An authentication bypass vulnerability exists in GFI Kerio Control 9.4.5 due to insecure default proxy configuration and weak access control in the GFIAgent service. The non-transparent proxy on TCP port 3128 can be used to forward unauthenticated requests to internal services such as GFIAgent,...

GFIAgent Service Bypass

The vulnerability of the GFIAgent software, a network filtering tool from Kerio Control, is related to the lack of authentication for a critical function. Exploiting this vulnerability allows an attacker to bypass existing security mechanisms by sending specially crafted HTTP requests...

CVE-2025-34069

An authentication bypass vulnerability exists in GFI Kerio Control 9.4.5 due to insecure default proxy configuration and weak access control in the GFIAgent service. The non-transparent proxy on TCP port 3128 can be used to forward unauthenticated requests to internal services such as GFIAgent,...

CVE-2025-34069

An authentication bypass vulnerability exists in GFI Kerio Control 9.4.5 due to insecure default proxy configuration and weak access control in the GFIAgent service. The non-transparent proxy on TCP port 3128 can be used to forward unauthenticated requests to internal services such as GFIAgent,...

CVE-2025-34071

A remote code execution vulnerability in GFI Kerio Control 9.4.5 allows attackers with administrative access to upload and execute arbitrary code through the firmware upgrade feature. The system upgrade mechanism accepts unsigned .img files, which can be modified to include malicious scripts with...