CVE-2012-2953: Symantec Web Gateway management console OS command injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

critical priorityUnauthenticated remote command execution with a CVSS 2.0 score of 10 and very high EPSS probability makes this an urgent patch target despite no KEV listing.

What it is

The management console in Symantec Web Gateway 5.0.x before 5.0.3.18 fails to properly sanitize input passed to application scripts, allowing OS command injection. An unauthenticated remote attacker can execute arbitrary commands on the appliance, which sits at a network perimeter and can expose traffic and credentials.

Impact

An attacker gains arbitrary command execution with the privileges of the web application, leading to full compromise of the appliance and potential lateral movement into the network it protects.

Attack surface

Reachable over the network via the management console's application scripts; the CVSS vector AV:N/AC:L/Au:N indicates no authentication and no user interaction are required.

Exploitation

Not listed in CISA KEV and no ransomware associations are documented; EPSS is high at 0.67389 (99.27th percentile), and references include a Vendor Advisory, but no public exploit code is confirmed in the record.

What to do

• Upgrade Symantec Web Gateway to 5.0.3.18 or later as specified in the vendor advisory.
• Restrict management console access to trusted administrative networks and block it from the internet.
• Place the management interface behind a firewall or VPN with strict allowlists.
• Monitor and review logs from the management console for unexpected script or command activity.
• If patching is delayed, isolate the appliance from untrusted networks and consider compensating controls such as a WAF.

Detection

• Inspect web server and application logs for requests to management console scripts containing shell metacharacters or command separators.
• Monitor for unexpected child processes spawned by the web server or application service on the appliance.
• Alert on outbound connections from the appliance to unknown hosts that could indicate command-and-control or data exfiltration.
• Review authentication and access logs for management console access from untrusted source IP addresses.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.