External risk intelligence

Maxum Rumpus OS Command Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-55055

Maxum Rumpus is a file transfer server (FTP/web-based) designed specifically for remote file access and management. By its nature as an internet-facing service for file transfers, it is commonly deployed in a way that makes it reachable from the public internet.

OS Command Injection

Maxum Rumpus

9.0.12

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory describes a critical security flaw impacting the Maxum Rumpus file transfer service. The vulnerability allows unauthorized individuals to execute commands on affected systems without needing any credentials, potentially leading to a complete compromise of the server. The main concern is confirming if this technology is in use and, if so, assessing the exposure.

Allows unauthorized command execution on servers.
Critical flaw affects remote file access systems.
Verify use and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted input to the Maxum Rumpus service over the network. Because no authentication is required, an unauthenticated attacker can trigger the vulnerability. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system, potentially leading to a complete compromise of the affected system.

No authentication needed for access.
Triggered by specially crafted network input.
Risk of operating system command execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to execute arbitrary operating system commands on the server when supported by the advisory. This may affect the confidentiality, integrity, and availability of the affected system.

Server command execution.
Via specially crafted network requests.
System compromise and data loss.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical OS command injection vulnerability in Maxum Rumpus affects external-facing file transfer services. Ownership likely falls to the platform or infrastructure team responsible for the Rumpus servers, in coordination with the security team for exposure assessment. The immediate first step is to inventory all Rumpus instances, determine their internet reachability, and confirm business criticality to prioritize remediation efforts.

Platform/infrastructure teams own remediation.
Verify internet exposure and business criticality.
Plan coordinated vendor engagement and patching.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Maxum Rumpus?

Maxum Rumpus is a server software designed for file transfers. It provides organizations with a platform to manage, upload, and download files remotely, often supporting FTP and web-based interfaces to facilitate document exchange between users and network storage.

What does CWE-78 mean for CVE-2025-55055?

CVE-2025-55055 is categorized as an OS Command Injection vulnerability. This means the software fails to properly filter input, allowing an attacker to inject and execute their own operating system commands. Essentially, the server mistakenly interprets malicious data as authorized instructions, granting the attacker control over the underlying system.

How is this vulnerability triggered?

An attacker triggers this flaw by sending specially crafted network requests to the Rumpus service. Because the vulnerability does not require any prior authentication, simply reaching the service with this specific input is sufficient to initiate the unauthorized command execution. Normal file transfer activity that does not contain these specific malicious inputs will not trigger the bug.

Is my Rumpus instance at high risk?

Halo Surface Signal indicates that Maxum Rumpus is typically deployed as an internet-facing service to enable remote file access. Because it is designed to be reachable from the public internet, it faces a higher probability of being targeted by remote attackers compared to services restricted to internal, private networks.

How should I respond to this threat?

Your first step is to conduct an inventory to locate all Rumpus instances within your infrastructure. Once identified, determine which servers are accessible from the internet and evaluate their business criticality. Coordinate with your platform or infrastructure teams to prepare for vendor-supplied updates or security mitigations to secure these systems.

References

www.gov.il/en/departments/dynamiccollectors/cve_advisories_listi…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.