CVE-2025-11073 Keyfactor RG-EW5100BE HTTP POST Request cmd command injection

A vulnerability was detected in Keyfactor RG-EW5100BE EW3.0B11P280EW5100BE-PRO12183019. The affected element is an unknown function of the file /cgi-bin/luci/api/cmd of the component HTTP POST Request Handler. The manipulation of the argument url results in command injection. The attack can be...

CVE-2025-11073

CVE-2025-11073 affects Keyfactor RG-EW5100BE EW_3.0B11P280_EW5100BE-PRO_12183019: the HTTP POST Request Handler in /cgi-bin/luci/api/cmd has an argument url that can be manipulated to trigger command injection. The vulnerability is remote and the exploit is public. Connected records consistently ...

CVE-2025-11073: Improper Neutralization of Special Elements used in a Command

A vulnerability was detected in Keyfactor RG-EW5100BE EW3.0B11P280EW5100BE-PRO12183019. The affected element is an unknown function of the file /cgi-bin/luci/api/cmd of the component HTTP POST Request Handler. The manipulation of the argument url results in command injection. The attack can be...

CVE-2024-34458

Keyfactor Command 10.5.x before 10.5.1 and 11.5.x before 11.5.1 allows SQL Injection which could result in information disclosure...

CVE-2024-42006

Keyfactor AWS Orchestrator through 2.0 allows Information Disclosure...

CVE-2024-33872

Keyfactor Command 10.5.x before 10.5.1 and 11.5.x before 11.5.1 allows SQL Injection which could result in code execution and escalation of privileges...

CVE-2024-36066

The CMP CLI client in KeyFactor EJBCA before 8.3.1 has only 6 octets of salt, and is thus not compliant with the security requirements of RFC 4211, and might make man-in-the-middle attacks easier. CMP includes password-based MAC as one of the options for message integrity and authentication the...

CVE-2024-49201

Keyfactor Remote File Orchestrator aka remote-file-orchestrator 2.8 before 2.8.1 allows Information Disclosure: sensitive information could be exposed at the debug logging level...

CVE-2024-49202

Keyfactor Command before 12.5.0 has Incorrect Access Control: access tokens are over permissioned, aka 64099. The fixed versions are 11.5.1.1, 11.5.2.1, 11.5.3.1, 11.5.4.5, 11.5.6.1, 11.6.0, 12.2.0.1, 12.3.0.1, 12.4.0.1, 12.5.0, and 24.4.0...

CVE-2023-34196

In the Keyfactor EJBCA before 8.0.0, the RA web certificate distribution servlet /ejbca/ra/cert allows partial denial of service due to an authentication issue. In configurations using OAuth, disclosure of CA certificates attributes and public keys to unauthenticated or less privileged users may...

CVE-2022-34831

An issue was discovered in Keyfactor PrimeKey EJBCA before 7.9.0, related to possible inconsistencies in DNS identifiers submitted in an ACME order and the corresponding CSR submitted during finalization. During the ACME enrollment process, an order is submitted containing an identifier for one o...

EJBCA injection vulnerability

EJBCA is an open source Public Key Infrastructure PKI and Certificate Authority CA software from Keyfactor Open Source. An injection vulnerability exists in EJBCA version 8.0 that stems from a redirection attack that could result from modifying the Host header...

CVE-2024-49201

Keyfactor Remote File Orchestrator aka remote-file-orchestrator 2.8 before 2.8.1 allows Information Disclosure: sensitive information could be exposed at the debug logging level...

CVE-2024-49202

Keyfactor Command before 12.5.0 has Incorrect Access Control: access tokens are over permissioned, aka 64099. The fixed versions are 11.5.1.1, 11.5.2.1, 11.5.3.1, 11.5.4.5, 11.5.6.1, 11.6.0, 12.2.0.1, 12.3.0.1, 12.4.0.1, 12.5.0, and 24.4.0...

CVE-2024-49201

Keyfactor Remote File Orchestrator aka remote-file-orchestrator 2.8 before 2.8.1 allows Information Disclosure: sensitive information could be exposed at the debug logging level...

CVE-2024-49201

Keyfactor Remote File Orchestrator aka remote-file-orchestrator 2.8 before 2.8.1 allows Information Disclosure: sensitive information could be exposed at the debug logging level...

CVE-2024-49202

Keyfactor Command before 12.5.0 has Incorrect Access Control: access tokens are over permissioned, aka 64099. The fixed versions are 11.5.1.1, 11.5.2.1, 11.5.3.1, 11.5.4.5, 11.5.6.1, 11.6.0, 12.2.0.1, 12.3.0.1, 12.4.0.1, 12.5.0, and 24.4.0...

CVE-2024-49202

Keyfactor Command before 12.5.0 has Incorrect Access Control: access tokens are over permissioned, aka 64099. The fixed versions are 11.5.1.1, 11.5.2.1, 11.5.3.1, 11.5.4.5, 11.5.6.1, 11.6.0, 12.2.0.1, 12.3.0.1, 12.4.0.1, 12.5.0, and 24.4.0...

PT-2024-33343

Name of the Vulnerable Software and Affected Versions Keyfactor Remote File Orchestrator versions 2.8 before 2.8.1 Description The issue allows sensitive information to be exposed at the debug logging level, potentially leading to information disclosure. Recommendations For versions 2.8 before...

CVE-2024-49201

The Keyfactor Remote File Orchestrator (also known as remote-file-orchestrator ) version 2.8 before 2.8.1 is vulnerable to an Information Disclosure flaw. The root cause is that sensitive information can be exposed when the system is set to the debug logging level . To remediate this vulnerabilit...