Vaelsys OS vgrid_server.php OS Command Injection Vulnerability (CVE-2025-8259)

VSEC_V4_2025_07_0001: Vaelsys OS Command Injection Vulnerability (vgrid_server.php) Vulnerability Overview In the file of Vaelsys OS, the function contains an OS command injection vulnerability. An attacker can inject and execute arbitrary operating system commands via the parameter. This vulnerability requires no authentication (only a valid session), and exploitation allows command execution with the privileges of the web server process user (www-data). CVE ID: CVE-2025-8259 CVSS Score: 7.3 (HIGH) Status: Fixed Affected Scope Vifence3: All versions (discontinued) VaelsysV4 (VaelsysOS 8): All versions VaelsysV4 (VaelsysOS 10): 4.0.0 - 5.1.0 VaelsysV4 (VaelsysOS 12): 5.1.1 - 5.4.0 Remediation It is recommended to upgrade affected systems to the following fixed versions: VaelsysV4 (VaelsysOS 10): Upgrade to 5.1.1 VaelsysV4 (VaelsysOS 12): Upgrade to 5.4.1 Vifence3 / VaelsysOS 8: Discontinued; recommend replacing the device or applying network mitigations (restrict network access). Vulnerability Verification (POC) Vaelsys provides the script for vulnerability verification. Script Usage: Description: The script sends a crafted request to the vulnerable handler. A valid PHP session identifier is required (can be obtained from the login page), but no authentication is needed. If the target is vulnerable, the script returns 0; otherwise it returns 1.

Goal Reached Thanks to every supporter — we hit 100%!

Vaelsys OS vgrid_server.php OS Command Injection Vulnerability (CVE-2025-8259)