CVE-2025-34069: Critical Auth Bypass in GFI Kerio Control

CVE-2025-34069 is a critical (CVSS 9.8) authentication bypass in GFI Kerio Control 9.4.5. An insecure default proxy setting lets unauthenticated requests reach the internal GFIAgent service. The SSD advisory points to 9.5.p1 or newer as the fix. Upgrade and restrict the proxy.

What's affected

GFI Kerio Control 9.4.5 (build 8526 per the SSD advisory) is the affected version in the record. The SSD advisory says the vendor released a fix and tells customers to upgrade to GFI Kerio Control 9.5.p1 or newer. Confirm this against the current GFI release notes.

Three CVEs come from the same research and are best handled together: CVE-2025-34069 (proxy based authentication bypass), CVE-2025-34070 (missing authentication in GFIAgent) and CVE-2025-34071 (unsigned firmware images).

How to check if you're exposed

Open the Kerio Control administration console and read the version and build. 9.4.5 is in the affected range. Then check what is reachable. The SSD advisory says the non-transparent proxy on TCP 3128 is enabled by default, and that the GFIAgent service listens on ports 7995 and 7996. From a machine outside your trusted network, check whether any of those ports respond, and review firewall rules to make sure no inbound rule exposes them.

This is a shipped product or appliance, not a package you import, so a manifest scan will not list it. Use your asset inventory, procurement records or network discovery to find every instance, then compare the version you find against the fixed version in the vendor notes. Safeguard's free in-browser dependency scan and the Gold directory are useful for the open source parts of your estate, and you can look up this CVE in Gold to see how it is tracked.

What to do now

1. Identify every Kerio Control appliance and note its version.
2. Upgrade to GFI Kerio Control 9.5.p1 or newer, as the SSD advisory states, and confirm in the GFI release notes.
3. Restrict which clients may use the proxy on port 3128, and never expose it to the internet.
4. Do not add inbound firewall rules for the GFIAgent ports 7994 to 7997.
5. Restrict administrative access to a management network and use strong, unique admin credentials.
6. Review appliance logs for unfamiliar administrative sessions or upgrade uploads.

Why it matters

The record maps this to CWE-306, missing authentication for a critical function. The non-transparent proxy on port 3128 can forward unauthenticated requests to internal services such as GFIAgent, which sidesteps the firewall that is supposed to protect them. From there an attacker can retrieve the appliance UUID and issue administrative requests, leading to full administrative access, per the record.

A firewall that proxies for outsiders is a classic design trap: the trusted internal network is only trusted if nothing can relay traffic into it. The record does not flag exploitation in the wild and the CVE is not on the CISA KEV list. The VulnCheck advisory notes a public proof of concept exists, so patch quickly.

Quick check

Sources

• SSD Secure Disclosure advisory
• VulnCheck advisory

Last reviewed: 18 October 2026.