CVE-2025-54769(xorux / lpar2rrd)

🚨 PoC released for an authenticated LPAR2RRD remote code execution vulnerability; CVE-2025-54769 PoC: https://github.com/tunahantekeoglu/CVE-2025-54769 The flaw allows an authenticated read-only user to abuse the LPAR2RRD upgrade functionality to upload a crafted file and achieve remote code execution through directory traversal. CVSS: 8.8 Affected: LPAR2RRD ≤ 8.04 Fixed: LPAR2RRD ≥ 8.05 The PoC builds and uploads a minimal upgrade archive, then verifies successful code execution by retrieving the output of whoami.

🚨 PoC RELEASED: CVE-2025-54769 — authenticated remote code execution in LPAR2RRD (CVSS 8.8). Root cause: a read-only authenticated user can abuse the upgrade upload path. A crafted archive whose filename includes directory traversal can still be written even when the appliance rejects the package as an invalid upgrade, overwriting Perl modules and leading to code execution as the lpar2rrd user. KoreLogic reported it as KL-001-2025-016. ⚠️ Affected: LPAR2RRD ≤ 8.04. Fixed in 8.05. CVSS 8.8 from CISA's secondary assessment. Not in CISA KEV. ⚠️ A public PoC exists; ThreatWire has not run it. 🔴 Upgrade to LPAR2RRD 8.05 or later, and review who has even read-only access to the appliance. Full breakdown 👉 https://www.threatwire.tech/news/lpar2rrd-authenticated-rce-is-cve-2025-54769 #CyberSecurity #InfoSec #RCE #LPAR2RRD