CVE-2015-5453
Watchguard XCS 9.2 and 10.0 before build 150522 allow remote authenticated users to execute arbitrary commands via shell metacharacters in the id parameter to ADMIN/mailqueue.spl.
- EPSS
- 58% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-31)
- CWE
- CWE-77
- Published
- Modified
- Record from
- the NVD, synced
Affected
- watchguard:xcs
References
- http://packetstormsecurity.com/files/132498/Watchguard-XCS-10.0-SQL-Injection-Command-Execution.html
- http://packetstormsecurity.com/files/133721/Watchguard-XCS-Remote-Command-Execution.html
- http://www.rapid7.com/db/modules/exploit/freebsd/http/watchguard_cmd_exec
- http://www.security-assessment.com/files/documents/advisory/Watchguard-XCS-final.pdf
- http://www.securityfocus.com/bid/75516