CVE-2025-34300 — AI Deep Analysis Summary

Q: Who is affected? (Versions/Components)

📦 **Affected Product**: Sawtooth Lighthouse Studio (Joint Analysis Platform). 📉 **Versions**: All versions **prior to 9.16.14**. 🏢 **Vendor**: Sawtooth Software (USA).

Q: Is exploitation threshold high? (Auth/Config)

⚠️ **Threshold**: **LOW**. 🔑 **Auth**: Pre-authentication. No login credentials needed to exploit. 🌐 **Config**: Remote exploitation is possible via the web interface.

Q: Is there a public Exp? (PoC/Wild Exploitation)

🔓 **Public Exp**: **YES**. 📜 **PoCs Available**: 1. Nuclei template (ProjectDiscovery). 2. Python script (CVE-2025-34300POC). 🌍 **Status**: Active exploitation tools are publicly available on GitHub.

Q: How to self-check? (Features/Scanning)

🔍 **Self-Check**: 1. Use Nuclei with the CVE-2025-34300 template. 2. Run the Python POC script against target URLs. 3. Check if the server version is < 9.16.14.

Q: Is it fixed officially? (Patch/Mitigation)

✅ **Official Fix**: **YES**. 🛠️ **Patch**: Upgrade to **Lighthouse Studio version 9.16.14** or later. 📥 **Source**: Official Sawtooth Software download page.

Q: Is it urgent? (Priority Suggestion)

🔥 **Urgency**: **CRITICAL**. ⏳ **Priority**: Immediate action required. 📢 **Reason**: Pre-auth RCE with public PoCs means automated attacks are likely already occurring. Patch immediately or isolate the service.

Updated May 08, 2026

This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login. Read the full analysis →

Q1What is this vulnerability? (Essence + Consequences)

🚨 **Essence**: A critical Remote Code Execution (RCE) vulnerability in Sawtooth Lighthouse Studio.…

Read full answer (login)

Q2Root Cause? (CWE/Flaw)

🛡️ **Root Cause**: CWE-20 (Improper Input Validation). <br>🔍 **Flaw**: Unsafe use of the `eval` function in the Perl CGI component `ciwweb.pl`.…

Read full answer (login)

Q3Who is affected? (Versions/Components)

📦 **Affected Product**: Sawtooth Lighthouse Studio (Joint Analysis Platform). <br>📉 **Versions**: All versions **prior to 9.16.14**. <br>🏢 **Vendor**: Sawtooth Software (USA).

Q4What can hackers do? (Privileges/Data)

💀 **Attacker Actions**: Execute arbitrary Perl code remotely. <br>🔓 **Privileges**: Unauthenticated access required.…

Read full answer (login)

Q5Is exploitation threshold high? (Auth/Config)

⚠️ **Threshold**: **LOW**. <br>🔑 **Auth**: Pre-authentication. No login credentials needed to exploit. <br>🌐 **Config**: Remote exploitation is possible via the web interface.

Q6Is there a public Exp? (PoC/Wild Exploitation)

🔓 **Public Exp**: **YES**. <br>📜 **PoCs Available**: <br>1. Nuclei template (ProjectDiscovery). <br>2. Python script (CVE-2025-34300POC). <br>🌍 **Status**: Active exploitation tools are publicly available on GitHub.

Q7How to self-check? (Features/Scanning)

🔍 **Self-Check**: <br>1. Use Nuclei with the CVE-2025-34300 template. <br>2. Run the Python POC script against target URLs. <br>3. Check if the server version is < 9.16.14.

Q8Is it fixed officially? (Patch/Mitigation)

✅ **Official Fix**: **YES**. <br>🛠️ **Patch**: Upgrade to **Lighthouse Studio version 9.16.14** or later. <br>📥 **Source**: Official Sawtooth Software download page.

Q9What if no patch? (Workaround)

🚧 **No Patch Workaround**: <br>1. **Block Access**: Restrict access to `ciwweb.pl` via WAF or firewall rules. <br>2.…

Read full answer (login)

Q10Is it urgent? (Priority Suggestion)

🔥 **Urgency**: **CRITICAL**. <br>⏳ **Priority**: Immediate action required. <br>📢 **Reason**: Pre-auth RCE with public PoCs means automated attacks are likely already occurring. Patch immediately or isolate the service.

Continue exploring

Vulnerability detail Full AI analysis (login) Sawtooth Software CWE-20