RCE in Tg8 Firewall
CVE-2021-4470
TG8 Firewall contains a pre-authentication remote code execution vulnerability in the runphpcmd.php endpoint. The syscmd POST parameter is passed directly to a system command without validation and executed with root privileges. A remote, unauthenticated attacker can supply crafted values to execute arbitrary operating system commands as root, resulting in full device compromise.
Vulnerability class: Command Injection (OS Command Injection)
EPSS: 0.010 (60.1th percentile) — read the EPSS interpretation.
Affected products
- Tg8 Firewall — versions 0
Weakness classification (CWE)
References
- disclosure@vulncheck.com (technical-description, exploit)
- disclosure@vulncheck.com (product)
- disclosure@vulncheck.com (third-party-advisory)