CVE-2026-65638: fallo crítico en ConfigServer Security & Firewall
Publicada el
Seguir esta CVE+ Monitorear ConfigServer Security & Firewall+ Monitorear ConfigServer Security & Firewall
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
28Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 9.2epss 2.3%
Improper escaping of a request URL in ConfigServer Security & Firewall allows an unauthenticated remote attacker to execute arbitrary commands as the CSF service account via shell command injection.
The vulnerability affects versions of the software originally distributed by ConfigServer, as well as versions of the WebPros-maintained fork that contain the vulnerable code. WebPros has addressed the vulnerability in version 16.30. Other forks or independently maintained versions of ConfigServer Security & Firewall (CSF) may also be affected and should be evaluated independently.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N
Productos afectados
ConfigServer · ConfigServer Security & FirewallWebPros · ConfigServer Security & FirewallCVEs relacionadas — ConfigServer Security & Firewall
En el mismo producto, de las más peligrosas a las menos.