CVE-2025-34115

OP5 Monitor <= 7.1.9 Authenticated Command Execution via command_test.php

8.7 HighPublic exploit

An authenticated command injection vulnerability exists in OP5 Monitor through version 7.1.9 via the 'cmd_str' parameter in the command_test.php endpoint. A user with access to the web interface can exploit the 'Test this command' feature to execute arbitrary shell commands as the unprivileged web application user. The vulnerability resides in the configuration section of the application and requires valid login credentials with access to the command testing functionality. This issue is fixed in version 7.2.0.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

3.48%Up 2.9 points since Jul 16, 2025

What each source reports

CVE List Score used 8.7

OP5 Monitor <= 7.1.9 Authenticated Command Execution via command_test.php

Record: CVE-2025-34115
CVSS 4.0: 8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weakness: CWE-78, CWE-306, CWE-20
Updated: 2026-11-02

EUVDEUVD-2025-21432 8.7

Record: EUVD-2025-21432
CVSS 4.0: 8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-gv2v-p8xm-xh87 8.7

An authenticated command injection vulnerability exists in OP5 Monitor through version 7.1.9 via...

Record: GHSA-gv2v-p8xm-xh87
CVSS 4.0: 8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness: CWE-20
Updated: 2026-11-02

NVD 8.7

Record: CVE-2025-34115
CVSS 4.0: 8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness: CWE-20, CWE-78, CWE-306
Updated: 2026-11-02

Affected products

itrs group op5 monitor

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Metasploit	op5 v7.1.9 Configuration Command Execution	2016-04-08

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, Metasploit, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-34115 is a high vulnerability (CVSS 8.7) in Itrs Group Op5 Monitor, published July 15, 2025. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 3.48%, the 89th percentile. No source names a fixed version.