CVE-2026-65638: falha crítica em ConfigServer Security & Firewall
Publicada em
Seguir esta CVE+ Monitorar ConfigServer Security & Firewall+ Monitorar ConfigServer Security & Firewall
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
28Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 9.2epss 2.3%
Improper escaping of a request URL in ConfigServer Security & Firewall allows an unauthenticated remote attacker to execute arbitrary commands as the CSF service account via shell command injection.
The vulnerability affects versions of the software originally distributed by ConfigServer, as well as versions of the WebPros-maintained fork that contain the vulnerable code. WebPros has addressed the vulnerability in version 16.30. Other forks or independently maintained versions of ConfigServer Security & Firewall (CSF) may also be affected and should be evaluated independently.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N
Produtos afetados
ConfigServer · ConfigServer Security & FirewallWebPros · ConfigServer Security & FirewallCVEs relacionadas — ConfigServer Security & Firewall
No mesmo produto, das mais perigosas para as menos.