CVE-2025-54306: An issue was discovered in the Thermo Fisher Torrent Suite Django application 5.18.1. A remote code execution…
CVE-2025-54306 · Severity: high · CVSS 7.2 · Published 2025-12-04
An issue was discovered in the Thermo Fisher Torrent Suite Django application 5.18.1. A remote code execution vulnerability exists in the network configuration functionality, stemming from insufficient input validation when processing network configuration parameters through administrative endpoints. The application allows administrators to modify the server's network configuration through the Django application. This configuration is processed by Bash scripts (TSsetnoproxy and TSsetproxy) that write user-controlled data directly to environment variables without proper sanitization. After updating environment variables, the scripts execute a source command on /etc/environment; if an attacker injects malicious data into environment variables, this command can enable arbitrary command execution. The vulnerability begins with the /admin/network endpoint, which passes user-supplied form data as arguments to subprocess.Popen calls. The user-supplied input is then used to update environment variables in TSsetnoproxy and TSsetproxy, and finally source $environment is executed.
No. Junglewise Threat Intelligence has no report of CVE-2025-54306 being exploited in the wild.
How severe is CVE-2025-54306?
High severity, with a CVSS score of 7.2, published 4 December 2025.
Which products and versions are affected?
Thermofisher Torrent Suite Software. The advisory does not name versions.
Is there a fix for CVE-2025-54306?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
Am I affected by CVE-2025-54306?
Check whether you run Thermofisher Torrent Suite Software. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.