CVE-2015-5082

KRITISCH 10.0CVE-2015-5082 · Published 28/09/2015 · updated 17/06/2026

Package	Affected versions	Patched versions
endian firewall endian_firewall	`≤ 2.5.1`	No fix yet

Description

Endian Firewall before 3.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) NEW_PASSWORD_1 or (2) NEW_PASSWORD_2 parameter to cgi-bin/chpasswd.cgi.

References

packetstormsecurity.com/files/133469/Endian-Firewall-Proxy-Password-Change-Command-Injection.html · Exploit
rapid7.com/db/modules/exploit/linux/http/efw_chpasswd_exec
exploit-db.com/exploits/37426 · Exploit
exploit-db.com/exploits/37428 · Exploit
exploit-db.com/exploits/38096 · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free