External risk intelligence

FOG Unauthenticated DB Dump Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2025-58443

FOG is a network-based cloning and imaging management system typically deployed within internal, segmented administrative networks to manage local client machines. While it involves a network-accessible interface, it is rarely intended for public internet exposure and is generally protected by internal network controls, making direct internet-facing exposure uncommon in standard deployments.

Authentication Bypass

Fogproject

1.5.10.1673 and earlier

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability exists in the FOG project's open-source cloning and imaging system, allowing unauthenticated attackers to extract the entire SQL database. This could expose sensitive system information without any credentials. A fix is anticipated, with immediate remediation advised through upgrading to a development branch.

Unauthorized database access is possible.
Protects sensitive system configuration data.
Confirm if your FOG system is exposed.

Attack Path

How an attacker could exploit the issue

An attacker could gain unauthorized access to sensitive information by exploiting a vulnerability in the FOG imaging system. This would likely begin by an attacker locating an exposed FOG server on a network. Without needing to log in, the attacker could then extract the entire database, potentially revealing system credentials or other confidential data.

No authentication required to access.
Triggered by requesting a database dump.
Full SQL database access.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to perform a full database dump from the FOG system. This could expose sensitive system configuration data and potentially related inventory or user information if stored within the database, under conditions where the FOG system is accessible over a network.

System configuration data.
Unauthenticated network access.
Exposure of sensitive inventory data.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in FOG Project likely impacts infrastructure or platform teams responsible for endpoint management and imaging systems. The first critical step is to identify all FOG instances within your environment, determine their reachability, and confirm their business criticality. Once identified, the accountable owner should be engaged to plan remediation based on the assessed risk.

Infrastructure and platform teams own this.
Verify FOG instance reachability and criticality.
Plan upgrade or apply vendor-recommended fix.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the FOG project software?

FOG is a free, open-source platform used by IT teams to manage computer imaging, cloning, and disk restoration. It acts as a centralized server that automates the deployment of operating systems and gathers hardware inventory data for local machines across an organization's network.

What is the weakness class behind CVE-2025-58443?

This vulnerability is classified as an authentication bypass and missing authentication for a critical function. In plain terms, the software fails to verify user credentials before executing commands. This allows an unauthenticated person to trick the system into performing a full database dump, which exposes sensitive information stored within the FOG SQL database.

How is this vulnerability triggered?

An attacker triggers this by sending a specific network request that asks the FOG server to perform a database dump. No special privileges or existing user accounts are required to initiate this process. The bug is not triggered by standard administrative operations, but rather by the system incorrectly allowing this specific, unauthorized data export request to bypass security checks entirely.

Is my FOG server at high risk?

According to Halo Surface Signal, risk depends on network placement. Because FOG is designed for internal administrative tasks, it is usually kept off the public internet. If your server is reachable from the public web, it faces a higher risk of being discovered and targeted. Servers isolated within internal, restricted networks are generally less likely to be accessed by external attackers.

How do I secure my FOG installation?

You should immediately upgrade your system to either the dev-branch or the working-1.6 branch, as these versions contain the necessary security patches. Start by locating all FOG instances in your environment to understand their current reachability. Once you have identified them, coordinate with your infrastructure team to apply the vendor-recommended update to prevent unauthorized database access.

References

github.com/FOGProject/fogproject/security/advisories/GHSA-mvwm-9…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.