CVE-2015-5082

EPSS 69.9%

Vexday Risk Score

50Attention

SSVC decision (CISA)

Attend

PoC available → attend closely

Exploit maturity

Functional exploit

Automatable exploit available (Nuclei/Metasploit).

CVSS —EPSS 69.9%KEV nãoPoC públicaNuclei —Metasploit simPatch —

Lifecycle

28 Jun 2015Metasploit module available

29 Jun 2015Public PoC

28 Sep 2015Published on NVD

Recommendation: Plan a near-term fix — a public PoC already exists.

Endian Firewall before 3.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) NEW_PASSWORD_1 or (2) NEW_PASSWORD_2 parameter to cgi-bin/chpasswd.cgi.

Affected products

n/a · n/a

public PoCs found — 7

cve_referencepacketstormsecurity.com/files/133469/Endian-Firewall-Proxy-Password-Change-Command-Injection.htmlunverified cve_referencewww.exploit-db.com/exploits/37426/unverified cve_referencewww.exploit-db.com/exploits/37428/unverified cve_referencewww.exploit-db.com/exploits/38096/unverified exploitdbwww.exploit-db.com/exploits/37426unverified exploitdbwww.exploit-db.com/exploits/37428unverified exploitdbwww.exploit-db.com/exploits/38096unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://packetstormsecurity.com/files/133469/Endian-Firewall-Proxy-Password-Change-Command-Injection.html https://www.exploit-db.com/exploits/37426/https://www.exploit-db.com/exploits/37428/https://www.exploit-db.com/exploits/38096/http://www.rapid7.com/db/modules/exploit/linux/http/efw_chpasswd_exec