VULNERABILITY INTELLIGENCE

CVE-2015-5082

CVSS score10 HIGH
EPSS probability69.91%
CISA KEVNot currently listed
Published2015-09-28
Last modified2026-06-17
CVSS vectorAV:N/AC:L/Au:N/C:C/I:C/A:C

Description

Endian Firewall before 3.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) NEW_PASSWORD_1 or (2) NEW_PASSWORD_2 parameter to cgi-bin/chpasswd.cgi.

Weakness classification

  • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')

Primary references