| Advisory ID | Severity | Release Date | Reported By | CVE ID |
| HSVD-2026-0027 | High | October 29, 2026 | External submission | N/A |
Overview
An authenticated vulnerability exists in Hillstone StoneOS (requires administrator privileges). The log export interface is affected by a command injection flaw: an attacker can inject a malicious payload via parameters, which the backend concatenates into a command and executes. Because the backend filters only certain characters, arbitrary commands can be executed with Root privileges.
Affected Products & Fix Versions
| Product | Affected Version | Fixed Version |
|---|---|---|
| NGFW | R8-R12 | 5.5R8P33, 5.5R10P18, 5.5R11P10, 5.5R12P3 |
| WAF | 3.0 and later | 3.6.15 |
| IPS | IPS4.6 and later | IPS6.4 |
| IFW | All versions | IFW4.4 |
| IDA | All versions | IDA4.4 |
| ADC | AX-5.5R8-3.1 through AX-5.5R12-5.0 | AX5.0.1 |
| BDS | BDS5.0 and later | BDS6.4 |
Remediation & Mitigation
- Upgrade to a fixed version to remediate this vulnerability.
Contact & Reporting
For technical support and detailed remediation guidance, contact Hillstone Networks support at +1-800-930-6707.
To report security issues in Hillstone products, email PSIRT@hillstonenet.com. Hillstone follows responsible disclosure principles and applicable regulations when handling product security incidents.
Legal notice — Without written authorization from Hillstone Networks, no organization or individual may modify, excerpt, or disseminate the content of this advisory for commercial purposes.
Recent Comments