CVE-2025-58443

The vulnerability results from missing required authentication when accessing the database export/dump function (CWE-306: Missing Authentication for Critical Function) and flawed identity verification (CWE-287: Improper Authentication). An attacker can send a specially crafted network request to the vulnerable endpoint and obtain a complete SQL database dump without providing any credentials. No special conditions are required – the attack is possible remotely, without authentication, and without user interaction.

An attacker can obtain a complete copy of the FOG Project system's SQL database, exposing all stored data, including potentially authentication credentials, information about managed infrastructure, and other sensitive configuration information. Compromising the database contents could enable further security breaches of the IT environment.

FOG Project should be updated immediately to the latest version from the dev-branch or working-1.6 branch, which contain a fix eliminating the vulnerability. The official patch version is planned for September 15, 2025. Step-by-step update instructions are available in the project documentation: https://docs.fogproject.org/en/latest/install-fog-server#choosing-a-fog-version

FOG Project (fogproject) in versions 1.5.10.1673 and all earlier versions