# CVE-2025-58443: FOGProject - Authentication Bypass

> Live exploitation tracking for CVE-2025-58443 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2025-58443

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 9.9
- **Public exploit available:** Yes
- **Affected products:** FOGProject
- **Weaknesses:** CWE-306 (Missing Authentication for Critical Function); CWE-287 (Improper Authentication)
- **Tags:** php, management_panel

## Description

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Versions 1.5.10.1673 and below contain an authentication bypass vulnerability. It is possible for an attacker to perform an unauthenticated DB dump where they could pull a full SQL DB without credentials. A fix is expected to be released 9/15/2025. To address this vulnerability immediately, upgrade to the latest version of either the dev-branch or working-1.6 branch. This will patch the issue for users concerned about immediate exposure.

## CrowdSec analysis

[CVE-2025-58443](https://euvd.enisa.europa.eu/vulnerability/CVE-2025-58443) is a critical authentication bypass vulnerability in FOG Project versions 1.5.10.1673 and earlier, allowing unauthenticated attackers to perform a full SQL database dump without credentials. This flaw exposes sensitive data and could be leveraged for data theft, further attacks, or system compromise. Immediate upgrades to the latest development or working branches are recommended to mitigate this severe risk.

CrowdSec has been tracking this vulnerability and its exploits since 19th of November 2025.

CrowdSec has not observed any significant exploitation activity targeting CVE-2025-58443 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers exploit this vulnerability by sending unauthenticated requests to endpoints such as `/fog/management/index.php` and `/fog/service/getversion.php`, bypassing authentication to gain access to the FOGProject management interface and sensitive configuration data.

## Timeline

- 2025-09-06: CVE Published. CVE-2025-58443 is published to NVD.
- 2025-11-19: Rule Released. CrowdSec releases a rule to detect CVE-2025-58443 exploitation attempts against the CrowdSec Network.
- 2025-12-08: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2025-58443 for the first time.

## References

- https://github.com/FOGProject/fogproject/security/advisories/GHSA-mvwm-9m2h-87p9
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-58443.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2025-58443) follows observed exploitation activity for CVE-2025-58443. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.