Vulnerability record · CVE-2015-5082 · published 28 September 2015
CVE-2015-5082: Endian Firewall chpasswd.cgi command injection via password parameters
Endian Firewall · Endian Firewall
Endian Firewall before 3.0 passes the NEW_PASSWORD_1 and NEW_PASSWORD_2 parameters of cgi-bin/chpasswd.cgi to a shell without sanitizing shell metacharacters, allowing command injection. Because the endpoint is reachable over the network without authentication, an attacker can run arbitrary commands on the firewall itself.
Description
Endian Firewall before 3.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) NEW_PASSWORD_1 or (2) NEW_PASSWORD_2 parameter to cgi-bin/chpasswd.cgi.
AV:N/AC:L/Au:N/C:C/I:C/A:C
Automated analysis
critical priorityUnauthenticated remote command execution on a perimeter firewall with public exploit code and very high EPSS probability.
What it is
Endian Firewall before 3.0 passes the NEW_PASSWORD_1 and NEW_PASSWORD_2 parameters of cgi-bin/chpasswd.cgi to a shell without sanitizing shell metacharacters, allowing command injection. Because the endpoint is reachable over the network without authentication, an attacker can run arbitrary commands on the firewall itself.
Impact
An attacker gains arbitrary command execution on the firewall, which typically means full control of the device, including its configuration and any traffic it inspects or routes.
Attack surface
Reached over the network via HTTP requests to cgi-bin/chpasswd.cgi, per the AV:N/AC:L/Au:N vector no authentication or user interaction is required. The description does not state whether the endpoint is exposed only on internal interfaces.
Exploitation
Public exploit code exists (Packet Storm, Exploit-DB entries 37426, 37428, 38096, and a Rapid7 Metasploit module), and EPSS is 0.699 with a 0.993 percentile, indicating high likelihood of exploitation. It is not listed in CISA KEV.
What to do
- Upgrade Endian Firewall to 3.0 or later, which the description states fixes the flaw.
- If upgrade is not immediately possible, restrict access to cgi-bin/chpasswd.cgi and the management interface to trusted networks only.
- Do not expose the firewall's web management interface to untrusted networks.
- Review firewall and web logs for requests to chpasswd.cgi with shell metacharacters in password parameters.
Detection
- Search web server logs for requests to cgi-bin/chpasswd.cgi containing shell metacharacters (;, |, $(), backticks) in NEW_PASSWORD_1 or NEW_PASSWORD_2.
- Monitor for unexpected child processes spawned by the web server user, such as shells or network utilities.
- Alert on outbound connections originating from the firewall host itself to unusual destinations.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2015-5082 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2015-5082), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
