CVE-2025-5106: Fujian Kelixun RCE Vulnerability

CVE-2025-5106 Overview

CVE-2025-5106 is an operating system (OS) command injection vulnerability in Fujian Kelixun 1.0. The flaw resides in the /app/fax/fax_view.php script within the Filename Handler component. Attackers can manipulate the fax_file argument to inject arbitrary shell commands that execute on the underlying host. The vulnerability is exploitable remotely over the network and requires no authentication or user interaction. The exploit has been publicly disclosed. The vendor was notified before publication but did not respond, leaving deployed systems exposed without an official patch. The weakness is tracked under CWE-77, Improper Neutralization of Special Elements used in a Command.

Critical Impact
Remote, unauthenticated attackers can inject arbitrary OS commands through the fax_file parameter, leading to command execution on the affected device.

Affected Products

Fujian Kelixun 1.0
Component: /app/fax/fax_view.php (Filename Handler)
Parameter: fax_file

Discovery Timeline

2025-05-23 - CVE-2025-5106 published to the National Vulnerability Database (NVD)
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-5106

Vulnerability Analysis

The vulnerability is an OS command injection in the Fujian Kelixun 1.0 web application. The script /app/fax/fax_view.php accepts a user-supplied fax_file argument and passes it to a system-level command without proper neutralization of shell metacharacters. An attacker can append shell operators such as ;, &&, |, or backticks to the parameter value to execute arbitrary commands in the context of the web server process.

Because fax_view.php is reachable over HTTP and does not require authentication, exploitation can occur from any network position that can reach the device. Successful exploitation results in command execution, which on embedded fax appliances commonly runs as a privileged service account.

The public disclosure on GitHub and the VulDB entry document the affected endpoint and parameter, increasing the likelihood of opportunistic scanning. The Exploit Prediction Scoring System (EPSS) places this CVE in the upper percentile of disclosed vulnerabilities for short-term exploitation likelihood.

Root Cause

The root cause is improper input neutralization [CWE-77]. The fax_file parameter is concatenated into a shell command string and dispatched through a system execution function such as system(), exec(), or shell_exec() in PHP. No allowlist validation, escaping, or argument-array invocation is applied before the value reaches the shell.

Attack Vector

The attack vector is network-based. An attacker sends a crafted HTTP request to /app/fax/fax_view.php with a malicious value in the fax_file parameter. The injected payload uses shell metacharacters to chain attacker-controlled commands to the original command. No credentials, tokens, or user interaction are required to trigger the flaw.

The vulnerability manifests when the web layer forwards the unsanitized parameter to a shell. Refer to the VulDB CTI Report and the GitHub Issue Report for the disclosed proof-of-concept details.

Detection Methods for CVE-2025-5106

Indicators of Compromise

HTTP requests targeting /app/fax/fax_view.php that contain shell metacharacters (;, |, &, `, $() in the fax_file query string or body parameter.
Web server processes spawning unexpected child processes such as sh, bash, wget, curl, nc, or busybox shortly after access to fax_view.php.
Outbound connections from the appliance to attacker-controlled hosts immediately following requests to the fax module.
New cron entries, modified startup scripts, or unfamiliar binaries dropped into writable directories on the device.

Detection Strategies

Inspect web access logs for requests to /app/fax/fax_view.php where fax_file contains URL-encoded shell operators (%3B, %7C, %26, %60).
Deploy network signatures that match the URI path and metacharacter patterns in the fax_file argument.
Correlate HTTP requests to fax_view.php with process-execution telemetry on the appliance, when host telemetry is available.

Monitoring Recommendations

Forward web server and reverse-proxy logs to a centralized analytics platform and alert on anomalous fax_file values.
Monitor for unexpected outbound traffic from the fax appliance, which typically communicates only with internal mail or telephony systems.
Baseline normal process trees of the web service so that any shell invocation triggers a high-severity alert.

How to Mitigate CVE-2025-5106

Immediate Actions Required

Restrict network access to the Fujian Kelixun 1.0 web interface so that only trusted management hosts can reach /app/fax/fax_view.php.
Disable or remove the fax_view functionality if it is not in use until a vendor patch is available.
Place the appliance behind a web application firewall (WAF) configured to block shell metacharacters in the fax_file parameter.
Audit web server, system, and outbound network logs for signs of prior exploitation.

Patch Information

No vendor patch is available. According to the disclosure, the vendor was contacted before publication but did not respond. Organizations operating Fujian Kelixun 1.0 should treat the device as unpatched and apply compensating controls. Monitor the VulDB advisory for any vendor update.

Workarounds

Block external access to the management interface using firewall rules or network segmentation.
Add WAF or reverse-proxy rules that reject requests to /app/fax/fax_view.php containing characters such as ;, |, &, `, $, \n, or \r in the fax_file parameter.
Require VPN or zero-trust network access before allowing connections to the appliance.
Consider replacing the appliance if vendor support and patches remain unavailable.

bash

# Example nginx rule to block shell metacharacters in fax_file
location /app/fax/fax_view.php {
    if ($arg_fax_file ~* "[;|&`$\\\\]") {
        return 403;
    }
    # Optionally restrict by source IP
    allow 10.0.0.0/8;
    deny all;
}