CVE-2025-50674
📋 TL;DR
A privilege escalation vulnerability in OpenMediaVault's changePassword method allows local authenticated users to gain root privileges. This affects OpenMediaVault 7.4.17 installations where users have local access to the system. Attackers can exploit this to completely compromise the NAS system.
💻 Affected Systems
- OpenMediaVault
📦 What is this software?
Openmediavault by Openmediavault
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with root access, allowing data theft, destruction, or persistence mechanisms installation.
Likely Case
Local authenticated users escalate to root, gaining full control over the NAS system and all stored data.
If Mitigated
Limited impact if proper access controls restrict local user accounts and network segmentation is implemented.
🎯 Exploit Status
Exploit requires local authenticated access. Public proof-of-concept available in references.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 7.4.18 or later
Vendor Advisory: http://openmediavault.com
Restart Required: No
Instructions:
1. Update OpenMediaVault via web interface or command line. 2. Run 'omv-upgrade' as root. 3. Verify version is 7.4.18 or higher.
🔧 Temporary Workarounds
Restrict Local User Access
linuxLimit local user accounts to only necessary personnel and implement strict access controls.
Disable Unnecessary Local Accounts
linuxRemove or disable local user accounts that don't require system access.
sudo deluser <username>
sudo usermod -L <username>
🧯 If You Can't Patch
- Implement strict network segmentation to isolate OpenMediaVault from other critical systems
- Monitor for privilege escalation attempts and review local user activity logs regularly
🔍 How to Verify
Check if Vulnerable:
Check OpenMediaVault version: 'cat /etc/openmediavault/version' or via web interface. If version is 7.4.17, system is vulnerable.Check Version:
cat /etc/openmediavault/versionVerify Fix Applied:
Verify version is 7.4.18 or higher using 'cat /etc/openmediavault/version' or web interface.📡 Detection & Monitoring
Log Indicators:
- Unusual privilege escalation attempts in auth.log
- Root access from non-privileged user accounts
- Changes to /usr/share/php/openmediavault/system/user.inc
Network Indicators:
- Local authentication followed by privilege escalation patterns
SIEM Query:
source="auth.log" AND ("sudo" OR "su") AND user!="root" AND result="success"