| Advisory ID | Severity | Release Date | Reported By | CVE ID |
| HSVD-2026-0031 | High | October 29, 2026 | External submission | N/A |
Overview
The network connectivity test function of the troubleshooting tools in Hillstone WAF, ADC (AX Series) and ADC contains a command injection vulnerability. An authenticated administrator can craft a specially formed input that causes the backend to pass attacker-controlled content into the shell when assembling the diagnostic command, allowing arbitrary system commands to be executed on the device with root privileges.
Affected Products & Fix Versions
| Product | Affected Version | Fixed Version |
|---|---|---|
| WAF | WAF2.3 and later | W-5.5R8-3.6.15, W-5.5R12-4.1.2 |
| ADC | AX3.1-AX5.0 | AX5.0.1 |
Remediation & Mitigation
- Upgrade to a fixed version to remediate this vulnerability.
Contact & Reporting
For technical support and detailed remediation guidance, contact Hillstone Networks support at +1-800-930-6707.
To report security issues in Hillstone products, email PSIRT@hillstonenet.com. Hillstone follows responsible disclosure principles and applicable regulations when handling product security incidents.
Legal notice — Without written authorization from Hillstone Networks, no organization or individual may modify, excerpt, or disseminate the content of this advisory for commercial purposes.
Recent Comments