CVE-2025-34108

HighCVSS 8.6/10Last modified Oct 29, 2026

Description

A stack-based buffer overflow vulnerability exists in the login functionality of Disk Pulse Enterprise version 9.0.34. An attacker can send a specially crafted HTTP POST request to the /login endpoint with an overly long username parameter, causing a buffer overflow in the libspp.dll component. Successful exploitation allows arbitrary code execution with SYSTEM privileges.

Metrics

CVSS 4.0 8.6/10CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-20CWE-121

Affected software

VendorProductVersions
FlexenseDisk Pulse Enterprise9.0.34

References

Timeline

Published
Jul 15, 2025
Last modified
Oct 29, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-341098.5PSEvents.exe in multiple Panda Security products runs hourly with SYSTEM privileges and loads DLL files from a user-writable directory withoCVE-2025-34116.3A vulnerability, which was classified as critical, has been found in mymagicpower AIAS 20250308. This issue affects some unknown processing CVE-2025-341109.3A directory traversal vulnerability exists in ColoradoFTP Server ≤ 1.3 Build 8 for Windows, allowing unauthenticated attackers to read or wrCVE-2025-341119.8An unauthenticated arbitrary file upload vulnerability exists in Tiki Wiki CMS Groupware version 15.1 and earlier via the ELFinder componentCVE-2025-3411210.0An authenticated multi-stage remote code execution vulnerability exists in Riverbed SteelCentral NetProfiler and NetExpress 10.8.7 virtual aCVE-2025-341138.7An authenticated command injection vulnerability exists in Tiki Wiki CMS versions ≤14.1, ≤12.4 LTS, ≤9.10 LTS, and ≤6.14 via the `viewmode` CVE-2025-341148.4A client-side security misconfiguration vulnerability exists in OpenBlow whistleblowing platform across multiple versions and default deployCVE-2025-341158.7An authenticated command injection vulnerability exists in OP5 Monitor through version 7.1.9 via the 'cmd_str' parameter in the command_testCVE-2025-341168.7A remote command execution vulnerability exists in IPFire before version 2.19 Core Update 101 via the 'proxy.cgi' CGI interface. An authentiCVE-2025-341179.3A remote code execution vulnerability exists in multiple Netcore and Netis routers models with firmware released prior to August 2014 due toCVE-2025-341188.7A path traversal vulnerability exists in Linknat VOS Manager versions prior to 2.1.9.07, including VOS2009 and early VOS3000 builds, that alCVE-2025-341198.8A remote file disclosure vulnerability exists in EasyCafe Server 2.2.14, exploitable by unauthenticated remote attackers via TCP port 831. T
CVE-2025-34108: High severity, CVSS 8.6 | Vulnix