Riverbed SteelCentral NetProfiler / NetExpress 10.8.7 RCE

published 2025-07-15 15 mo ago modified 2026-07-28 3 mo ago also EUVD-2025-21430

cvss: 10.0; version 4.0, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 2.8%; EPSS 2.8% chance of exploitation in 30 days, percentile 86%
public exploits: 1; Metasploit

An authenticated multi-stage remote code execution vulnerability exists in Riverbed SteelCentral NetProfiler and NetExpress 10.8.7 virtual appliances. A SQL injection vulnerability in the '/api/common/1.0/login' endpoint can be exploited to create a new user account in the appliance database. This user can then trigger a command injection vulnerability in the '/index.php?page=licenses' endpoint to execute arbitrary commands. The attacker may escalate privileges to root by exploiting an insecure sudoers configuration that allows the 'mazu' user to execute arbitrary commands as root via SSH key extraction and command chaining. Successful exploitation allows full remote root access to the virtual appliance.

Timeline

2016-06-27 First public exploit (Metasploit exploit/linux/http/riverbed_netprofiler_netexpress_exec)
2025-07-15 Published

CISA SSVC

Exploitation: Proof of concept is public
Automatable: yes
Technical impact: total
Assessed: 15 mo ago (2025-07-15)

Exploit prediction

2.82% chance of exploitation in the next 30 days, higher than 86% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

Metasploit exploit/linux/http/riverbed_netprofiler_netexpress_exec Riverbed SteelCentral NetProfiler/NetExpress Remote Code Execution metasploit exploit, excellent rank, 2016-06-27
exploit-db.com https://www.exploit-db.com/exploits/40108 referenced PoC, tagged "exploit" by a source, unverified
raw.githubusercontent.com https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/http/riverbed_netprofiler_netexpress_exec.rb referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	4.0	10.0	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CNA	4.0	10.0	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected products

Riverbed Technology SteelCentral NetExpress
Riverbed Technology SteelCentral NetProfiler

Classification

Weakness

CWE-89 Improper Neutralization of Special Elements used in an SQL Command
CWE-78 Improper Neutralization of Special Elements used in an OS Command
CWE-306 Missing Authentication for Critical Functionality
CWE-266 Incorrect Privilege Assignment

References

Sources

CVE List CVE-2025-34112
NVD CVE-2025-34112

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary