CVE-2025-54123
High PUBLISHEDHoverfly vulnerable to remote code execution at `/api/v2/hoverfly/middleware` endpoint due to insecure middleware implementation
Not yet in CISA KEV
Recommended Action
Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.
At a Glance
Hoverfly is an open source API simulation tool. In versions 1.11.3 and prior, the middleware functionality in Hoverfly is vulnerable to command injection vulnerability at `/api/v2/hoverfly/middleware` endpoint due to insufficient validation and sanitization in user input. The vulnerability exists in the middleware management API endpoint `/api/v2/hoverfly/middleware`. This issue is born due to combination of three code level flaws: Insufficient Input Validation in middleware.go line 94-96; Unsafe Command Execution in local_middleware.go line 14-19; and Immediate Execution During Testing in hoverfly_service.go line 173. This allows an attacker to gain remote code execution (RCE) on any system running the vulnerable Hoverfly service. Since the input is directly passed to system commands without proper checks, an attacker can upload a malicious payload or directly execute arbitrary commands (including reverse shells) on the host server with the privileges of the Hoverfly process. Commit 17e60a9bc78826deb4b782dca1c1abd3dbe60d40 in version 1.12.0 disables the set middleware API by default, and subsequent changes to documentation make users aware of the security changes of exposing the set middleware API.
- CVE Published
- Sep 10, 2025
- Exploitation Reported
- Nov 11, 2025
- CVSS
- 9.8 Critical
- EPSS
- —
Affected Versions
| Vendor | Product | Version | Status |
|---|---|---|---|
| SpectoLabs |
hoverfly
|
<= 1.11.3 |
Affected |
CVE References
- https://github.com/SpectoLabs/hoverfly/security/advisories/GHSA-r4h8-hfp2-ggmf github.com · CVE Record https://github.com/SpectoLabs/hoverfly/security/advisories/GHSA-r4h8-...
- https://github.com/SpectoLabs/hoverfly/commit/17e60a9bc78826deb4b782dca1c1abd3dbe60d40 github.com · CVE Record https://github.com/SpectoLabs/hoverfly/commit/17e60a9bc78826deb4b782d...
- https://github.com/SpectoLabs/hoverfly/commit/a9d4da7bd7269651f54542ab790d0c613d568d3e github.com · CVE Record https://github.com/SpectoLabs/hoverfly/commit/a9d4da7bd7269651f54542a...
- https://github.com/SpectoLabs/hoverfly/blob/master/core/hoverfly_service.go#L173 github.com · CVE Record https://github.com/SpectoLabs/hoverfly/blob/master/core/hoverfly_serv...
- https://github.com/SpectoLabs/hoverfly/blob/master/core/middleware/local_middleware.go#L13 github.com · CVE Record https://github.com/SpectoLabs/hoverfly/blob/master/core/middleware/lo...
Show 1 more reference
- https://github.com/SpectoLabs/hoverfly/blob/master/core/middleware/middleware.go#L93 github.com · CVE Record https://github.com/SpectoLabs/hoverfly/blob/master/core/middleware/mi...
Recommended Actions
- Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.
- Check enrichment artifacts for scanner coverage and available PoCs before rolling remediation validation.
- Use the Pro API to automate enrichment, telemetry, and workflow delivery for VM, SOC, and CTI pipelines.
Known Exploited Vulnerability Sources
Catalogues that list this CVE as a known exploited vulnerability.
Per-source evidence links for KEV attestations are available through the KEVIntel Pro API.
Learn about Pro API access| Source | Added |
|---|---|
| The Shadowserver First | 2025-11-11 00:00 UTC |
Scanner Artifacts
Nuclei and Metasploit references linked to this CVE.
| Scanner | Reference | Detected |
|---|---|---|
| Nuclei | https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-54123.yaml | Jun 01, 2026 |
Virtual Patch
Compensating WAF rules to help reduce exposure to this CVE. Rule content and deployable vendor exports are available with KEVIntel Enterprise.
KEVIntel does not currently have a virtual patch for this CVE. When available, KEVIntel virtual patches ship as deployable ModSecurity, Cloudflare, and AWS WAF rules.
Enterprise feature. Virtual patch rule content and deployable vendor exports (ModSecurity, Cloudflare, AWS WAF) are available to KEVIntel Enterprise users.
CVSS Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitation Status
Exploited in the wild
Recorded 2025-11-11 00:00:00 UTC · The Shadowserver
Proof of concept available
Recorded 2026-06-12 14:21:08 UTC · Nuclei Templates
Weaknesses (CWE)
-
Improper Input Validation
-
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Scanner Integrations
| Scanner | Reference | Detected |
|---|---|---|
| Nuclei | https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-54123.yaml | Jun 01, 2026 |
Potential Proof of Concepts
These PoCs are unverified and could contain malware. Use at your own risk.
nuclei · Created Unknown
Timeline
Key exploitation, disclosure, scanner coverage, and KEV attestation events for this CVE.
-
14:21 UTC about 1 month ago14:21 UTC · about 1 month ago
Public PoC available
Public proof-of-concept code published
-
15:34 UTC about 2 months ago15:34 UTC · about 2 months ago
Nuclei template available
Scanner coverage available
-
00:00 UTC 8 months ago00:00 UTC · 8 months ago
Added to KEVIntel KEV Feed
High-confidence, third-party attested exploitation
-
18:41 UTC 10 months ago18:41 UTC · 10 months ago
CVE published
Vulnerability disclosed publicly
-
23:53 UTC about 1 year ago23:53 UTC · about 1 year ago
CVE ID reserved
Identifier reserved by the CNA
Automate This Intelligence with the Pro API
Confidence scoring, exploit status, sensor telemetry, PoCs, scanner integrations, mentions, and tags are available programmatically for VM, SOC, and CTI workflows.
Pro API Example
GET /api/v2/pro/kevs/CVE-2025-54123
{
"cve_id": "CVE-2025-54123",
"title": "Hoverfly vulnerable to remote code execution at \`/api/v2/hoverfly/middleware\`...",
"affected_vendor": "SpectoLabs",
"affected_product": "hoverfly",
"affected_versions": [
{ "vendor": "...", "product": "...", "status": "affected", "display_label": "..." }
],
"confidence": "High",
"cvss_score": 9.8,
"epss_score": null,
"exploit_status": {
"exploited_in_the_wild": true,
"active_exploitation_observed": false
},
"sensor_telemetry": { "...": "Pro API fields" },
"proof_of_concepts": [ "..." ],
"scanner_integrations": [ "..." ]
}