CVE-2018-17431: Comodo UTM Firewall Web Console unauthenticated remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityUnauthenticated remote code execution on a perimeter firewall with public exploit code and very high EPSS makes this an urgent patch target.

What it is

The Web Console in Comodo UTM Firewall before 2.7.0 fails to properly authenticate requests, allowing a remote attacker to execute arbitrary code via a crafted URL. Because the flaw is reachable over the network with no credentials, it exposes the firewall's management interface to full compromise.

Impact

An unauthenticated attacker gains arbitrary code execution on the firewall appliance, which can lead to full device takeover and control over the network perimeter it protects.

Attack surface

Reachable over the network through the Web Console HTTP interface; the CVSS vector (AV:N/AC:L/PR:N/UI:N) and the description indicate no authentication and no user interaction are required.

Exploitation

Public exploit code is referenced (Packetstorm and a GitHub PoC), and EPSS is very high at 0.839 (99.7th percentile), though the CVE is not listed in CISA KEV.

What to do

• Upgrade Comodo UTM Firewall to version 2.7.0 or later, which the description states fixes the flaw.
• Restrict network access to the Web Console so it is not exposed to untrusted networks, using firewall rules or management VLANs.
• Place the management interface behind a VPN or authenticated reverse proxy if it must be reachable remotely.
• Monitor vendor advisories for any further guidance, since the record does not list additional patches or workarounds.

Detection

• Inspect Web Console access logs for crafted or anomalous URLs targeting the management interface.
• Alert on unexpected outbound connections or process execution originating from the firewall appliance.
• Monitor for authentication bypass patterns, such as requests reaching privileged console functions without a prior successful login.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.