CVE-2025-34070 is a critical (CVSS 9.8) missing authentication flaw in the GFIAgent component of GFI Kerio Control 9.4.5. Its HTTP services on ports 7995 and 7996 skip authentication. The SSD advisory points to 9.5.p1 or newer as the fix. Upgrade and keep those ports closed.
What's affected
GFI Kerio Control 9.4.5 (build 8526 per the SSD advisory) is the affected version in the record. The SSD advisory says the vendor released a fix and tells customers to upgrade to GFI Kerio Control 9.5.p1 or newer. Confirm this against the current GFI release notes.
Three CVEs come from the same research and are best handled together: CVE-2025-34069 (proxy based authentication bypass), CVE-2025-34070 (missing authentication in GFIAgent) and CVE-2025-34071 (unsigned firmware images).
How to check if you're exposed
Open the Kerio Control administration console and read the version and build. 9.4.5 is in the affected range. Then check what is reachable. The SSD advisory says the non-transparent proxy on TCP 3128 is enabled by default, and that the GFIAgent service listens on ports 7995 and 7996. From a machine outside your trusted network, check whether any of those ports respond, and review firewall rules to make sure no inbound rule exposes them.
This is a shipped product or appliance, not a package you import, so a manifest scan will not list it. Use your asset inventory, procurement records or network discovery to find every instance, then compare the version you find against the fixed version in the vendor notes. Safeguard's free in-browser dependency scan and the Gold directory are useful for the open source parts of your estate, and you can look up this CVE in Gold to see how it is tracked.
What to do now
- Identify every Kerio Control appliance and note its version.
- Upgrade to GFI Kerio Control 9.5.p1 or newer, as the SSD advisory states, and confirm in the GFI release notes.
- Restrict which clients may use the proxy on port 3128, and never expose it to the internet.
- Do not add inbound firewall rules for the GFIAgent ports 7994 to 7997.
- Restrict administrative access to a management network and use strong, unique admin credentials.
- Review appliance logs for unfamiliar administrative sessions or upgrade uploads.
Why it matters
This is CWE-306, missing authentication for a critical function. Per the record, the proxy handler on port 7996 forwards requests to administrative endpoints when given an Appliance UUID, and that UUID can be read from port 7995. The result is a complete authentication bypass with access to sensitive administrative APIs.
The lesson for builders is that an identifier is not a credential. A UUID that the service hands out freely cannot protect anything. For defenders, the answer is patching and keeping management agents off any network that untrusted clients can reach. The record does not flag exploitation, and the CVE is not on the CISA KEV list.
Quick check
Which ports host the vulnerable GFIAgent services?
The record names ports 7995 and 7996.
Sources
Last reviewed: 18 October 2026.
