CVE-2025-67858
A crafted "interface" input parameter can lead to integrity loss of the firewall configuration
A Improper Neutralization of Argument Delimiters vulnerability in Foomuuri can lead to integrity loss of the firewall configuration or further unspecified impact by manipulating the JSON configuration passed to nft.
This issue affects Foomuuri: from ? before 0.31.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- High
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
A crafted "interface" input parameter can lead to integrity loss of the firewall configuration
A Improper Neutralization of Argument Delimiters vulnerability in Foomuuri can lead to integrity loss of the firewall configuration or further unspecified impact by manipulating the JSON configuration passed to nft.
This issue affects Foomuuri: from ? before 0.31.
- Record
CVE-2025-67858- CVSS 4.0
- 7.0 High
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N - Weakness
- CWE-88
- Updated
- 2026-11-02
EUVDEUVD-2026-1509
A Improper Neutralization of Argument Delimiters vulnerability in Foomuuri can lead to integrity loss of the firewall configuration or further unspecified impact by manipulating the JSON configuration passed to nft.
This issue affects Foomuuri: from ? before 0.31.
- Record
EUVD-2026-1509- CVSS 4.0
- 7.0 High
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-hjvr-2r84-cx23
A Improper Neutralization of Argument Delimiters vulnerability in Foomuuri can lead to integrity...
A Improper Neutralization of Argument Delimiters vulnerability in Foomuuri can lead to integrity loss of the firewall configuration or further unspecified impact by manipulating the JSON configuration passed to nft.
This issue affects Foomuuri: from ? before 0.31.
- Record
GHSA-hjvr-2r84-cx23- CVSS 4.0
- 7.0 High
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Weakness
- CWE-88
- Updated
- 2026-11-02
NVD
A Improper Neutralization of Argument Delimiters vulnerability in Foomuuri can lead to integrity loss of the firewall configuration or further unspecified impact by manipulating the JSON configuration passed to nft.
This issue affects Foomuuri: from ? before 0.31.
- Record
CVE-2025-67858- CVSS 4.0
- 7.0 High
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Weakness
- CWE-88
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2025-67858
A Improper Neutralization of Argument Delimiters vulnerability in Foomuuri can lead to integrity loss of the firewall configuration or further unspecified impact by manipulating the JSON configuration passed to nft. This issue affects Foomuuri: from ? before 0.31.
- Record
DEBIAN-CVE-2025-67858- CVSS 4.0
- 7.0 High
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Updated
- 2026-11-02
OSVUBUNTU-CVE-2025-67858
A Improper Neutralization of Argument Delimiters vulnerability in Foomuuri can lead to integrity loss of the firewall configuration or further unspecified impact by manipulating the JSON configuration passed to nft. This issue affects Foomuuri: from ? before 0.31.
- Record
UBUNTU-CVE-2025-67858- CVSS 4.0
- 7.0 High
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N - Updated
- 2026-11-02
OSVUSN-8326-1 No score
foomuuri vulnerabilities
Matthias Gerstner discovered that Foomuuri's D-Bus service did not properly enforce authorization. An unprivileged local attacker could possibly use this issue to manipulate the firewall configuration, contrary to expectations. (CVE-2025-67603)
Matthias Gerstner discovered that Foomuuri's D-Bus service did not properly validate interface names. A local attacker could possibly use this issue to manipulate the firewall configuration in unintended ways. (CVE-2025-67858)
- Record
USN-8326-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
foomuuriDebian:13 |
before 0.27-2+deb13u1, plus listed versions 0.27-2 |
0.27-2+deb13u1 |
foomuuriDebian:14 |
before 0.31-1, plus listed versions 0.27-20.28-10.28-1~bpo13+10.29-10.29-1~bpo13+10.30-10.30-1~bpo13+10.31-1~bpo13+1 |
0.31-1 |
foomuuriUbuntu:Pro:24.04:LTS |
before 0.22-1ubuntu0.1~esm1, plus listed versions 0.20-10.21-10.21-20.22-1 |
0.22-1ubuntu0.1~esm1 |
foomuuriUbuntu:25.10 |
before 0.27-2+deb13u1build0.25.10.1, plus listed versions 0.27-2 |
0.27-2+deb13u1build0.25.10.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-67858 is a high vulnerability (CVSS 7.0) in Https://github.com/foobaroy/ Foomuuri, published January 7, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.19%, the 8th percentile. Fixed in foomuuri 0.27-2+deb13u1.