by Kastro
Paper/Archive/CVE-2024-8073

CVE-2024-8073

Hillstone Networks Hillstone Networks Web Application Firewall — Command Injection Vulnerability in Hillstone Networks Web Application Firewall

EPSS 1%CVSS 9.8
critical.is priorityof 100
43
CVSS 9.8 (CNA, NVD agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 66.6.666 × 2013.3No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Improper Input Validation vulnerability in Hillstone Networks Hillstone Networks Web Application Firewall on 5.5R6 allows Command Injection.This issue affects Hillstone Networks Web Application Firewall: from 5.5R6-2.6.7 through 5.5R6-2.8.13.

Affected

ProductAffectedFixed inSource
Hillstone Networks Web Application Firewall2.6.7 – 2.8.13–CNA
web_application_firewall5.5r6-2.6.7 – 5.5R6-2.8.13–CISA-ADP

Scores by source

Hillstone (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refhillstonenet.com.cn/security-notification/2024/08/21/mlzrld-2