Configserver Security Firewall
Monthly
Root-level OS command injection in ConfigServer Security & Firewall (CSF) lets a remote attacker who controls a configured allow/deny feed inject arbitrary shell commands through the advanced-rule parser, which executes them as root. The affected code exists both in the original ConfigServer distribution and in the WebPros-maintained fork; WebPros fixed it in version 16.30. There is no public exploit identified at time of analysis and no CISA KEV listing, so this is a high-severity but not yet demonstrated-exploited issue.
Remote code execution in ConfigServer Security & Firewall (CSF) allows an unauthenticated attacker to run arbitrary OS commands as the CSF service account through shell command injection stemming from improperly escaped request URLs. It affects the original ConfigServer distribution and the WebPros-maintained fork containing the vulnerable code, and is fixed in WebPros version 16.30. No public exploit has been identified at time of analysis, but because CSF's login-failure daemon typically runs with root-level privileges, successful exploitation grants full server control.
Root-level OS command injection in ConfigServer Security & Firewall (CSF) lets a remote attacker who controls a configured allow/deny feed inject arbitrary shell commands through the advanced-rule parser, which executes them as root. The affected code exists both in the original ConfigServer distribution and in the WebPros-maintained fork; WebPros fixed it in version 16.30. There is no public exploit identified at time of analysis and no CISA KEV listing, so this is a high-severity but not yet demonstrated-exploited issue.
Remote code execution in ConfigServer Security & Firewall (CSF) allows an unauthenticated attacker to run arbitrary OS commands as the CSF service account through shell command injection stemming from improperly escaped request URLs. It affects the original ConfigServer distribution and the WebPros-maintained fork containing the vulnerable code, and is fixed in WebPros version 16.30. No public exploit has been identified at time of analysis, but because CSF's login-failure daemon typically runs with root-level privileges, successful exploitation grants full server control.