A performance test tool that briefly opens a door with a rusty lock
Tenable plugin 297580 flags CVE-2025-54349, a heap buffer overflow in iperf3, fixed for Red Hat Enterprise Linux 9 by RHSA-2026:1760. The vulnerable component is the iperf3 network benchmarking utility, which can run as either a client or an unauthenticated server listening on TCP/5201.
The Nessus plugin reports a Risk Factor of Critical, but that overstates real-world exposure. iperf3 is not a persistent daemon and is almost never internet-facing; it is a temporary diagnostic tool run manually by administrators. With no known in-the-wild exploitation or public PoC, and no high-value role in the enterprise architecture, a MEDIUM assessment is more operationally honest.
4 steps from start to impact.
Reach a vulnerable iperf3 endpoint
iperf3 -s) listening on TCP 5201, or tricks an administrator into running iperf3 -c attacker.example. iperf3 has no authentication on the control or data channel, so any reachable server is a potential target.- Attacker can reach TCP/5201 from an untrusted network
- Alternatively, a user invokes iperf3 client against an attacker-controlled host
- Server mode is manually started and stops when the session ends; it is not a persistent daemon by default
- Most enterprise firewalls do not allow inbound 5201/tcp from the internet
Trigger the heap buffer overflow in iperf3
- A vulnerable version of iperf3 is running with the flawed parsing path
- Attacker can control input to the vulnerable function
- Requires a version-specific exploit; no public PoC is known
- SELinux on RHEL 9 may constrain process behavior after a crash, but not prevent the corruption
Achieve code execution in the iperf3 process context
- Reliable heap grooming despite ASLR and PIE
- A working ROP chain or shellcode compatible with binary protections
- ASLR, PIE, stack canaries, and heap hardening complicate reliable exploitation
- No evidence of weaponization or mature exploit code
Move laterally from the compromised host
- Compromised host has network access to other sensitive systems
- Attacker can escalate privileges or reuse stored credentials
- iperf3 is not a persistent high-privilege service; blast radius is local
- Config management and vulnerability scanners flag this plugin quickly, prompting patching
dnf remove iperf3) to eliminate the attack surface immediately.firewalld) to block inbound/outbound 5201 except for trusted subnets; do not run iperf3 -s persistently. This breaks the remote network step of the attack path.iperf3 -s via endpoint process monitoring or auditd; alert any outbound iperf3 client connections to non-approved destinations. This does not prevent exploitation but accelerates response.- Web Application Firewall — iperf3 is not HTTP, so a WAF offers no protection.
- MFA — iperf3 has no authentication layer, so MFA cannot gate access.
- IPS/IDS signatures for iperf3 — most intrusion systems lack specific detection for this overflow until vendor signatures ship.
The supporting signals.
| Tenable plugin | 297580 maps to CVE-2025-54349 — RHEL 9 iperf3 (RHSA-2026:1760) |
|---|---|
| Affected component | iperf3 on Red Hat Enterprise Linux 9; package version before RHSA-2026:1760 |
| Vulnerability class | Heap buffer overflow (CWE-122) |
| In-the-wild status | No known exploitation; not in CISA KEV as of this analysis |
| Public PoC availability | No public PoC identified on GitHub or pocindex.io |
| EPSS | Not available — CVE lacks NVD enrichment; no FIRST EPSS score |
| KEV status | Not listed in CISA KEV |
| Assessed realistic score | Base vector likely high if treated as unauth remote, but environment friction drops realistic severity to 5.5 |
| Fixed versions | RHEL 9 errata RHSA-2026:1760; upstream fix see iperf3 changelog |
| Exposure scanning | No widespread internet exposure of 5201/tcp in Shodan/GreyNoise-style scans; mostly internal/ephemeral |
Sources.
Why this verdict
- Role multiplier: low. iperf3 is not an IdP, hypervisor, domain controller, CA, PAM, or edge appliance; it is a diagnostic utility. The worst plausible outcome is host-level compromise of a low-value troubleshooting tool, not domain or fleet takeover.
- Exposure is rare. iperf3 server mode is manually started and short-lived; it is not a default service. Few enterprises allow inbound 5201/tcp from untrusted networks, and the client-side path requires user interaction.
- Exploitation prerequisites stack up. Even if a vulnerable iperf3 instance is reachable, exploitation requires a version-specific heap attack under ASLR/PIE/heap hardening with no public PoC and no known in-the-wild activity.
Why not higher?
Although the Nessus plugin marks Critical, iperf3 is not a persistent internet-facing service and rarely runs as root. The path from remote attacker to code execution requires uncommon conditions — manually running server mode or a user connecting to a malicious endpoint — and modern memory protections on RHEL 9 further complicate exploit development.
Why not lower?
It remains a heap buffer overflow in a network-capable utility. If an affected host runs iperf3 in server mode and is reachable, unauthenticated code execution is plausible, so it cannot be dismissed as LOW or IGNORE. Patching should still be scheduled.
Crowdsourced verification payload.
Run on the RHEL 9 target host as root (any user with rpm query works). Example invocation: bash check_iperf3_cve_2025_54349.sh. Outputs VULNERABLE, PATCHED, or UNKNOWN.
#!/bin/bash
set -euo pipefail
pkg="iperf3"
if ! rpm -q "$pkg" >/dev/null 2>&1; then
echo "PATCHED (not installed)"
exit 0
fi
installed=$(rpm -q "$pkg")
if rpm -q --changelog "$installed" | grep -q 'CVE-2025-54349'; then
echo "PATCHED ($installed)"
exit 0
else
echo "VULNERABLE ($installed)"
exit 1
fi