| Advisory ID | Severity | Release Date | Reported By | CVE ID |
| HSVD-2025-0048 | High | January 22, 2026 | Internal disclosure | N/A |
Overview
Hillstone Products Arbitrary File Write Vulnerability Leading to Unauthenticated Remote Command Execution. This vulnerability is due to the fact that the system does not effectively filter the user’s input and directly splices the system command execution, resulting in a remote code execution vulnerability.
Affected Products & Fix Versions
| PRODUCT | AFFECTED VERSIONS | FIX VERSION |
|---|---|---|
| Firewall | Full version | 5.5R8P28, 5.5R10P14, 5.5R10P13, 5.5R11P6, 5.5R11P5.6 and after, 5.5R12 |
| IPS | Full version | IPS5.5.7 |
| BDS | Full version | BDS5.5.7 |
| WAF | Full version | WAF3.6.7 |
| LMS | Full version | LMS4.3.7 |
| CloudHive | Full version | CloudHive2.9.4B2.4 |
| ADC | Full version | AX4.4.4 |
Remediation & Mitigation
- Preferred: Upgrade to the fixed software version listed above for your product as soon as possible.
- Temporary workaround: If an immediate upgrade is not possible, restrict management access by configuring trusted host (admin host) settings and limiting management interface scope to trusted IP ranges only.
Contact & Reporting
For technical support and detailed remediation guidance, contact Hillstone Networks support at +1-800-930-6707.
To report security issues in Hillstone products, email PSIRT@hillstonenet.com. Hillstone follows responsible disclosure principles and applicable regulations when handling product security incidents.
Legal notice — Without written authorization from Hillstone Networks, no organization or individual may modify, excerpt, or disseminate the content of this advisory for commercial purposes.
Recent Comments