CVE-2025-14847 vulnerability Mongo Database

[PencilHCV]

hi!
Is Mongo Database vulnerable to CVE-2025-14847?

best regards,
Hugo C.V.

[sy]

Hi Hugo,

Zenarmor has stopped to support MongoDB. Please switch it to Elasticsearch or SQLite DB.

[PencilHCV]

Thanks for your suggestion. But still no one has been able to answer my question. Or is it not important if mongo database is vulnerable to inform all of us users, when this is a security product?

best regards,
Hugo

[Patrick M. Hausen]

As @sy wrote MongoDB is unsupported by ZA now and you should remove it from your security product. Which also solves the issue.

[PencilHCV]

Hi Patrick!
That's not what I want, I know what to do with Mongo Database on Zenarmor in OPNSense. What I want to bring up is whether Zenarmor or OPNSense have informed us users old and new that if you still use Mongo Database in Zenarmor to switch to SQL-Lite or Elasticsearch. But this is speculation because still NO ONE has answered whether Mongo Database used in Zenarmor is vulnerable to CVE-2025-14847. Which was my question from the beginning.
Not to offend you, but you sound more like politicians who avoid touching on the core question here and answer with something else.

best regards,
Hugo

[Patrick M. Hausen]

In their release notes for version 2.1 dated October 07, 2025 they stated:

The Elasticsearch version 5 and MongoDB databases are no longer available for new Zenarmor installations.

I don't know if that is sufficient for you. I agree they could be way more explicit sending out a warning message or even displaying one in the UI. Of course MongoDB in your particular version will most probably be subject to the cited CVE. Of course - how can it not be?

But it is your responsibility as the administrator to assess if your particular installation is affected by that vulnerability.

If e.g. MongoDB as installed with Zenarmor is only reachable via 127.0.0.1 you are not affected. That CVE describes a remotely exploitable data leak - which implies that your MongoDB can be contacted remotely. If it cannot, you are safe, even if it is vulnerable.

Nobody will be doing that job for you (although I just did in this particular case).

- read CVE
- understand CVE
- check if it is applicable to your particular situation
- act if necessary

Your job as an admin for any software you run. No open source product will give you an "make secure always" button.

[PencilHCV]

Hi Patrick,

Thank you for your response and for clarifying the situation.

I appreciate your insights about CVE-2025-14847, but I still feel that there should have been a clearer communication to users, especially given that MongoDB has been deprecated in Zenarmor. I understand it's my responsibility as an administrator to check for vulnerabilities, but it would be more helpful if there was an explicit warning or guidance from the Zenarmor team about how MongoDB users should handle these situations.

While I agree with your point that if MongoDB is not exposed remotely, the vulnerability may not apply, it's still concerning that users are left in the dark unless they are actively looking for this kind of information.

Once again, thanks for your input. I just think there's room for improvement in the way security updates and vulnerabilities are communicated to the user base.

Best regards,
Hugo