CVE-2025-58443 is a critical (CVSS 9.1) authentication bypass in FOG, the open source imaging and inventory suite. It lets an unauthenticated caller pull a full SQL database dump. The GitHub advisory lists fixes in 1.5.10.1693 and 1.6.0-beta.2225. Upgrade and keep the FOG server off untrusted networks.
What's affected
FOG versions 1.5.10.1673 and below, per the record. The GitHub advisory gives the vulnerable range as below 1.5.10.1693 and below 1.6.0-beta.2225.
Patched versions are 1.5.10.1693 or later and 1.6.0-beta.2225 or later, per the GitHub advisory.
The record, written earlier, said a fix was expected on 15 September 2025 and suggested the dev-branch or working-1.6 branch for immediate protection. The advisory later listed the patched version numbers above.
How to check if you're exposed
Find the version on your FOG server. It is shown in the web interface footer or about page, and in the installed files.
Then check who can reach the web interface. Look at your firewall rules and any reverse proxy in front of the server. Review web server access logs for unauthenticated requests to FOG management pages from outside your administration network.
What to do now
- Find every FOG server and its version.
- Upgrade to 1.5.10.1693, 1.6.0-beta.2225 or later, following the FOG documentation for choosing a version.
- Restrict the FOG web interface to your internal or administration network.
- If the server was reachable from untrusted networks, assume the database contents were exposed and rotate credentials stored in or managed through FOG.
- Review your logs for requests to the affected area from accounts or addresses that do not normally use it.
- Test with a low privilege account after patching to confirm the restriction now holds.
Why it matters
The advisory traces the problem to an authorization helper that treated a request as authorized when it carried a header that browsers add to background requests. That header is not a credential. Any client can add it, so the check provided no real protection for endpoints that relied on it.
The lesson is general. A request header that says how a call was made cannot prove who made it. Authentication has to be tied to a session or token that the server issued.
The record classifies the weakness as CWE-287 (Improper Authentication) and CWE-306 (Missing Authentication for Critical Function).
Access control bugs are quiet. Nothing crashes and no error appears, because the application does exactly what the request asked. The flaw is that the server never asked whether the caller was allowed to ask.
The durable fix is to check authorization on the server for every action, tied to the identity of the caller, and never to rely on what the browser interface chooses to show. Reviewing a few sensitive endpoints with a second account of lower privilege is a cheap way to find this class of problem before someone else does.
The record shows this CVE is not in the CISA Known Exploited Vulnerabilities catalog.
Quick check
Is the exposure only a data leak?
The record names an unauthenticated database dump. The advisory also describes other consequences, so treat an exposed server as compromised until you have reviewed it.
Which versions fix it?
1.5.10.1693 and 1.6.0-beta.2225, per the GitHub advisory.
Sources
Last reviewed: 18 October 2026.
