CVE-2024-58275

Description

Easywall 0.3.1 allows authenticated remote command execution via a command injection vulnerability in the /ports-save endpoint that suffers from a parameter injection flaw. Attackers can inject shell metacharacters to execute arbitrary commands on the server.

PUBLISHED Reserved 2025-12-04 | Published 2025-12-04 | Updated 2025-12-05 | Assigner VulnCheck

Problem types

CWE-88 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

Product status

Credits

Melvin Mejia finder

References

www.exploit-db.com/exploits/51856 (ExploitDB-51856) exploit

jpylypiw.github.io/easywall/ (Easywall Homepage) product

github.com/jpylypiw/easywall (Easywall GitHub Repository) product

www.vulncheck.com/...ommand-injection-in-ports-save-endpoint third-party-advisory

cve.org (CVE-2024-58275)

nvd.nist.gov (CVE-2024-58275)