FOGProject - Authentication Bypass (CVE-2025-58443)
Description
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Versions 1.5.10.1673 and below contain an authentication bypass vulnerability. It is possible for an attacker to perform an unauthenticated DB dump where they could pull a full SQL DB without credentials. A fix is expected to be released 9/15/2025. To address this vulnerability immediately, upgrade to the latest version of either the dev-branch or working-1.6 branch. This will patch the issue for users concerned about immediate exposure.
psychologyCrowdSec Analysis
CVE-2025-58443 is a critical authentication bypass vulnerability in FOG Project versions 1.5.10.1673 and earlier, allowing unauthenticated attackers to perform a full SQL database dump without credentials. This flaw exposes sensitive data and could be leveraged for data theft, further attacks, or system compromise. Immediate upgrades to the latest development or working branches are recommended to mitigate this severe risk.
CrowdSec has been tracking this vulnerability and its exploits since 19th of November 2025.
CrowdSec has not observed any significant exploitation activity targeting CVE-2025-58443 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.
Attackers exploit this vulnerability by sending unauthenticated requests to endpoints such as /fog/management/index.php and /fog/service/getversion.php, bypassing authentication to gain access to the FOGProject management interface and sensitive configuration data.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2025-09-06 |
| Rule Released | 2025-11-19 |
| CrowdSec First Seen | 2025-12-08 |
Related Weaknesses
The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.