| Advisory ID | Severity | Release Date | Reported By | CVE ID |
| HSVD-2026-0037 | High | October 23, 2026 | External submission | N/A |
Overview
An authenticated docker-to-cron root code execution vulnerability exists in the Docker management feature of Hillstone StoneOS. An authenticated administrator can import and launch an attacker-controlled Docker image via the Web management interface. Because the backend starts the container with high privileges, the container can directly access the host file system and process namespace, allowing it to write to the host’s crontab. Within one minute, the host’s crond executes the attacker’s command as root, reliably resulting in root code execution on the host.
Affected Products & Fix Versions
| Product | Affected Version | Fixed Version |
|---|---|---|
| WAF | WAF 3.6 and WAF 4.1 | 4.1.2 |
| NGFW | All versions of NGFW R10-R12 | R10P18, R11P10, R12P3 |
Remediation & Mitigation
- Upgrade to a fixed version to remediate this vulnerability.
Contact & Reporting
For technical support and detailed remediation guidance, contact Hillstone Networks support at +1-800-930-6707.
To report security issues in Hillstone products, email PSIRT@hillstonenet.com. Hillstone follows responsible disclosure principles and applicable regulations when handling product security incidents.
Legal notice — Without written authorization from Hillstone Networks, no organization or individual may modify, excerpt, or disseminate the content of this advisory for commercial purposes.
Recent Comments