| Advisory ID | Severity | Release Date | Reported By | CVE ID |
| HSVD-2026-0026 | High | October 29, 2026 | External submission | N/A |
Overview
A post-authentication vulnerability exists in Hillstone StoneOS involving the ptf blacklist lib auto-download chain (requires authenticated administrator privileges). An attacker can write a malicious URL configuration and then trigger an update; the backend concatenates the user-controlled URL into a curl command and executes it. Because the URL path is not properly sanitized, arbitrary commands can be executed with Root privileges.
Affected Products & Fix Versions
| Product | Affected Version | Fixed Version |
|---|---|---|
| IPS (NIPS/NIDS) | IPS 5.X | IPS 6.1 |
| IFW (Industrial NGFW) | IFW 4.0 and later | IFW 4.4 |
| ADC AX Series | ADC AX-5.5R10-4.0 to 4.5 | ADC AX-5.5R12-5.0 |
| NGFW | R10-R11 | 5.5R10P18, 5.5R11P10 |
Remediation & Mitigation
- Upgrade to firewall R12, ADC AX-5.5R12-5.0, IPS 6.0 or later to remediate this vulnerability.
Contact & Reporting
For technical support and detailed remediation guidance, contact Hillstone Networks support at +1-800-930-6707.
To report security issues in Hillstone products, email PSIRT@hillstonenet.com. Hillstone follows responsible disclosure principles and applicable regulations when handling product security incidents.
Legal notice — Without written authorization from Hillstone Networks, no organization or individual may modify, excerpt, or disseminate the content of this advisory for commercial purposes.
Recent Comments