CVE Feed

Dashboard / CVE / CVE-2015-5453

CVE-2015-5453

Watchguard XCS 9.2 and 10.0 before build 150522 allow remote authenticated users to execute arbitrary commands via shell metacharacters in the id parameter to ADMIN/mailqueue.spl.

Published:Jul 8, 2015

Last Modified:Apr 12, 2025

EPS:Jul 8, 2015

EPSS Score:0.72451

CVSS Score:6.5

Affected Products

Vendor

Product

Action

Vendor

Watchguard

Product

Xcs

Watchguard

Xcs

Exploits

http://packetstormsecurity.com/files/132498/Watchguard-XCS-10.0-SQL-Injection-Command-Execution.html http://packetstormsecurity.com/files/133721/Watchguard-XCS-Remote-Command-Execution.html http://www.security-assessment.com/files/documents/advisory/Watchguard-XCS-final.pdf https://www.exploit-db.com/exploits/38346/http://packetstormsecurity.com/files/132498/Watchguard-XCS-10.0-SQL-Injection-Command-Execution.html http://packetstormsecurity.com/files/133721/Watchguard-XCS-Remote-Command-Execution.html http://www.security-assessment.com/files/documents/advisory/Watchguard-XCS-final.pdf https://www.exploit-db.com/exploits/38346/https://www.exploit-db.com/exploits/38346

Common Weakness Enumeration

CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-136 LDAP Injection

CAPEC-15 Command Delimiters

CAPEC-183 IMAP/SMTP Command Injection

CAPEC-248 Command Injection

CAPEC-40 Manipulating Writeable Terminal Devices

CAPEC-43 Exploiting Multiple Input Interpretation Layers

CAPEC-75 Manipulating Writeable Configuration Files

CAPEC-76 Manipulating Web Input to File System Calls

Related CVEs

CVE-2015-5452 (CVSS 7.5) — SQL injection vulnerability in Watchguard XCS 9.2 and 10.0 before build 150522 allows remote attackers to exec…

CVE-2011-2165 (CVSS 6.8) — The STARTTLS implementation in WatchGuard XCS 9.0 and 9.1 does not properly restrict I/O buffering, which allo…

References

http://packetstormsecurity.com/files/132498/Watchguard-XCS-10.0-SQL-Injection-Command-Execution.html

http://packetstormsecurity.com/files/133721/Watchguard-XCS-Remote-Command-Execution.html

http://www.rapid7.com/db/modules/exploit/freebsd/http/watchguard_cmd_exec

http://www.security-assessment.com/files/documents/advisory/Watchguard-XCS-final.pdf

http://www.securityfocus.com/bid/75516

http://www.watchguard.com/support/release-notes/xcs/10/en-US/EN_Release_Notes_XCS_v10_0_Security_Hotfix/EN_Release_Notes_XCS_v10_0_Security_Hotfix.pdf

http://www.watchguard.com/support/release-notes/xcs/9/en-US/EN_ReleaseNotes_XCS_9_2_Security_Hotfix/EN_Release_Notes_XCS_v9_2_Security_Hotfix.pdf

https://www.exploit-db.com/exploits/38346/

http://packetstormsecurity.com/files/132498/Watchguard-XCS-10.0-SQL-Injection-Command-Execution.html

http://packetstormsecurity.com/files/133721/Watchguard-XCS-Remote-Command-Execution.html

http://www.rapid7.com/db/modules/exploit/freebsd/http/watchguard_cmd_exec

http://www.security-assessment.com/files/documents/advisory/Watchguard-XCS-final.pdf

http://www.securityfocus.com/bid/75516

http://www.watchguard.com/support/release-notes/xcs/10/en-US/EN_Release_Notes_XCS_v10_0_Security_Hotfix/EN_Release_Notes_XCS_v10_0_Security_Hotfix.pdf

http://www.watchguard.com/support/release-notes/xcs/9/en-US/EN_ReleaseNotes_XCS_9_2_Security_Hotfix/EN_Release_Notes_XCS_v9_2_Security_Hotfix.pdf

https://www.exploit-db.com/exploits/38346/

Common Vulnerability Scoring System

Attack Vector

Network

Adjacent

Local

Physical

Privileges Required

None

Low

High

User Interaction

None

Required

Scope

Unchanged

Changed

Confidentiality

None

Low

High

Integrity

None

Low

High

Availability

None

Low

High