CVE-2025-67858: A crafted "interface" input parameter can lead to integrity loss of the firewall configuration

Severity: high (CVSS 7.0 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-01-08 · updated 2026-10-11
Weakness: CWE-88

Description

A Improper Neutralization of Argument Delimiters vulnerability in Foomuuri can lead to integrity loss of the firewall configuration or further unspecified impact by manipulating the JSON configuration passed to `nft`. This issue affects Foomuuri: from ? before 0.31.

Affected products

https://github.com/FoobarOy/ Foomuuri: from ? before 0.31 — fixed in 0.31

How to fix

Upgrade to a fixed version: https://github.com/FoobarOy/ Foomuuri 0.31. Check the vendor advisory for mitigations.

References

https://bugzilla.suse.com/show_bug.cgi?id=CVE-2025-67858
https://security.opensuse.org/2026/01/07/foomuuri-lack-of-dbus-authorization.html

Get alerted when CVE-2025-67858 or the next vulnerability affects your stack