CVE-2025-24350: Arbitrary Certificate Write in ctrlX OS Device Admin

The impact of CVE-2025-24350 is substantial. Successful exploitation allows an attacker to inject malicious certificates into the system, potentially leading to man-in-the-middle attacks, compromised trust relationships, and unauthorized access to resources. An attacker could, for example, replace legitimate certificates with their own, enabling them to intercept and decrypt sensitive communications. The ability to write to arbitrary file system paths also increases the potential for further exploitation and lateral movement within the ctrlX OS environment. This vulnerability highlights a critical weakness in certificate management and could have far-reaching consequences for system security.

1. Reserved2025-01-20
2. Published2025-04-30
3. EPSS updated2026-03-23

The primary mitigation for CVE-2025-24350 is to upgrade ctrlX OS Device Admin to version 2.6.9 or later. If an immediate upgrade is not feasible, consider implementing temporary workarounds. Restrict access to the “Certificates and Keys” functionality to only authorized users. Implement strict input validation on all HTTP requests to prevent malicious data from being processed. Monitor file system activity for unexpected certificate modifications. While a WAF or proxy cannot directly prevent this vulnerability, it can be configured to detect and block suspicious HTTP requests targeting the certificate management endpoint. After upgrading, verify certificate integrity by inspecting the certificate store and ensuring that only legitimate certificates are present.