oxidized-web (aka Oxidized Web) の 0.15.0 より前のバージョンでは、RANCID 移行ページを通じて、認証されていないユーザーが oxidized-web を実行している Linux ユーザーアカウントの制御を獲得できる可能性があります。

The impact of CVE-2025-27590 is severe. Successful exploitation allows an attacker to execute arbitrary commands with the privileges of the Oxidized Web user. This could lead to complete system compromise, including data exfiltration, malware installation, and lateral movement within the network. Given Oxidized Web's role in network device configuration management, an attacker could potentially modify device configurations, disrupt network operations, or gain access to sensitive configuration data. The lack of authentication required for exploitation significantly broadens the attack surface.

Organizations utilizing Oxidized Web for network device configuration management are at risk, particularly those running versions 0.0 through 0.14.0. Environments with limited network segmentation or inadequate access controls are especially vulnerable, as an attacker could potentially exploit this vulnerability from outside the internal network.

• ruby / server:

  grep -r 'rancid_migration' /opt/oxidized/web/

• generic web:

  curl -I http://<oxidized_server>/rancid_migration | grep Server

1. 2025-03-03Disclosure

   disclosure

1. 予約済み2025-03-03
2. 公開日2025-03-03
3. 更新日2025-03-04
4. EPSS 更新日2026-04-02

The primary mitigation for CVE-2025-27590 is to immediately upgrade Oxidized Web to version 0.15.0 or later. If upgrading is not immediately feasible, consider implementing temporary workarounds such as restricting access to the RANCID migration page via a firewall or web application proxy. Carefully review and restrict the permissions of the Oxidized Web user account to minimize potential damage in the event of a compromise. Monitor system logs for suspicious activity related to the RANCID migration page.