A remote command execution vulnerability exists in IPFire versions prior to 2.19 Core Update 101. The flaw is located in the proxy.cgi CGI interface and allows an authenticated user to inject arbitrary shell commands by manipulating fields in the NCSA user creation form. Exploitation grants execution under the web server’s privileges, thus potentially compromising the entire system, its confidentiality, integrity, and availability.

IPFire firewalls running any version earlier than the 2.19 Core Update 101 release. The vulnerability applies to the default installation using the proxy.cgi script and the NCSA user creation interface.

The CVSS score of 8.7 classifies the weakness as high severity, and the EPSS probability of 61% indicates a high likelihood of exploitation in the wild. Attackers must first authenticate to IPFire and then submit malicious input via the user creation form; no public remote access is required. The issue is not listed in the CISA KEV catalog, but the combination of high CVSS and EPSS scores mandates prompt remediations.