CVE-2025-34071 is a critical (CVSS 9.8) code execution flaw in GFI Kerio Control 9.4.5. The firmware upgrade feature accepts unsigned image files, so someone with administrative access can run their own scripts as root. The SSD advisory points to 9.5.p1 or newer. Check whether it covers this issue.
What's affected
GFI Kerio Control 9.4.5 (build 8526 per the SSD advisory) is the affected version in the record. The SSD advisory says the vendor released a fix and tells customers to upgrade to GFI Kerio Control 9.5.p1 or newer. Confirm this against the current GFI release notes.
Three CVEs come from the same research and are best handled together: CVE-2025-34069 (proxy based authentication bypass), CVE-2025-34070 (missing authentication in GFIAgent) and CVE-2025-34071 (unsigned firmware images).
The SSD advisory says it does not make clear whether the image authenticity issue is covered separately from the other fixes, so ask GFI to confirm that 9.5.p1 or newer addresses signature checking.
How to check if you're exposed
Open the Kerio Control administration console and read the version and build. 9.4.5 is in the affected range. Then check what is reachable. The SSD advisory says the non-transparent proxy on TCP 3128 is enabled by default, and that the GFIAgent service listens on ports 7995 and 7996. From a machine outside your trusted network, check whether any of those ports respond, and review firewall rules to make sure no inbound rule exposes them.
This is a shipped product or appliance, not a package you import, so a manifest scan will not list it. Use your asset inventory, procurement records or network discovery to find every instance, then compare the version you find against the fixed version in the vendor notes. Safeguard's free in-browser dependency scan and the Gold directory are useful for the open source parts of your estate, and you can look up this CVE in Gold to see how it is tracked.
What to do now
- Identify every Kerio Control appliance and note its version.
- Upgrade to GFI Kerio Control 9.5.p1 or newer, as the SSD advisory states, and confirm in the GFI release notes.
- Restrict which clients may use the proxy on port 3128, and never expose it to the internet.
- Do not add inbound firewall rules for the GFIAgent ports 7994 to 7997.
- Restrict administrative access to a management network and use strong, unique admin credentials.
- Review appliance logs for unfamiliar administrative sessions or upgrade uploads.
- Only install firmware images downloaded directly from the vendor, and verify any published checksum.
Why it matters
The record lists CWE-306 here, though the description is about missing integrity validation of upgrade images. The system accepts .img files and executes scripts inside them after upload without checking that the vendor produced them. Because the record describes this as needing administrative access, it matters most when chained with the authentication bypass flaws CVE-2025-34069 and CVE-2025-34070, which can supply that access.
The chain is the real story. One flaw gets you in, another turns access into root. Patching removes the first link, and protecting administrative access removes the second. The record does not flag exploitation and the CVE is not on the CISA KEV list.
Quick check
Does this flaw need administrative access?
The record says it allows attackers with administrative access to upload and execute code, which is why it pairs with the two authentication bypass CVEs.
Sources
Last reviewed: 18 October 2026.
