在 oxidized-web (又名 Oxidized Web) 的 0.15.0 之前版本中，RANCID 迁移页面允许未认证用户获得对运行 oxidized-web 的 Linux 用户帐户的控制权。

The impact of CVE-2025-27590 is severe. Successful exploitation allows an attacker to execute arbitrary commands with the privileges of the Oxidized Web user. This could lead to complete system compromise, including data exfiltration, malware installation, and lateral movement within the network. Given Oxidized Web's role in network device configuration management, an attacker could potentially modify device configurations, disrupt network operations, or gain access to sensitive configuration data. The lack of authentication required for exploitation significantly broadens the attack surface.

Organizations utilizing Oxidized Web for network device configuration management are at risk, particularly those running versions 0.0 through 0.14.0. Environments with limited network segmentation or inadequate access controls are especially vulnerable, as an attacker could potentially exploit this vulnerability from outside the internal network.

• ruby / server:

  grep -r 'rancid_migration' /opt/oxidized/web/

• generic web:

  curl -I http://<oxidized_server>/rancid_migration | grep Server

1. 2025-03-03Disclosure

   disclosure

1. 已保留2025-03-03
2. 发布日期2025-03-03
3. 修改日期2025-03-04
4. EPSS 更新日期2026-04-02

The primary mitigation for CVE-2025-27590 is to immediately upgrade Oxidized Web to version 0.15.0 or later. If upgrading is not immediately feasible, consider implementing temporary workarounds such as restricting access to the RANCID migration page via a firewall or web application proxy. Carefully review and restrict the permissions of the Oxidized Web user account to minimize potential damage in the event of a compromise. Monitor system logs for suspicious activity related to the RANCID migration page.