ricardojoserf/emqx-RCE

ricardojoserf/emqx-RCE

GitHubGitHub
GitHubgithub.com
ricardojoserf.github.ioricardojoserf.github.io
Releases1
Frequency
Last Release
Stars47
EMQX Dashboard Malicious Plugin leading to RCE
Log in to subscribe

CVE History

CVEPublishedCVSS v3CVSS v2
CVE-2025-52136↗
3 LOW—

In EMQX before 5.8.6, administrators can install arbitrary novel plugins via the Dashboard web interface. NOTE: the Supplier's position is that this is the intended behavior; however, 5.8.6 adds a defense-in-depth feature in which a plugin's acceptability (for later Dashboard installation) is set by the "emqx ctl plugins allow" CLI command.