CVE-2024-58275CWE-88

CVE-2024-58275

published December 5, 2025

CVSS
8.7
EPSS
2%
Percentile
78.3
In the wild
Unconfirmed
What it is

Easywall 0.3.1 allows authenticated remote command execution via a command injection vulnerability in the /ports-save endpoint that suffers from a parameter injection flaw. Attackers can inject shell metacharacters to execute arbitrary commands on the server.

The record
Technical detail
CVSS
8.7 · NONE
CVSS v4.0
Not supplied
EPSS
0.01795 · 78.3th percentile
Weakness
CWE-88 · Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
Published
2025-12-05T02:16Z
References (4)
https://github.com/jpylypiw/easywall · [email protected]https://jpylypiw.github.io/easywall/ · [email protected]https://www.exploit-db.com/exploits/51856 · [email protected]https://www.vulncheck.com/advisories/easywall-031-authentication-bypass-via-command-injection-in-ports-save-endpoint · [email protected]
EPSS history
Timeline
  • 04 DEC 20:41Z
    Easywall 0.3.1 - Authentication Bypass via Command Injection in /ports-save Endpoint
    cvelistv5