The vulnerability in the XMLRPC software of the UserGate Next-Generation Firewall (NGFW), a unified management center called the UserGate Management Center (UGMC), the UserGate Log Analyzer (LogAn) system for log collection, the UserGate Security Information and Event Management (SIEM) system, and the UserGate Web Application Firewall (WAF) allows attackers to disclose protected information.

The vulnerability of the XMLRPC software on the UserGate Next-Generation Firewall NGFW, as well as the UserGate Management Center UGMC and the UserGate Log Analyzer LogAn system, is related to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to...

CVE-2025-44882

A command injection vulnerability in the component /cgi-bin/firewall.cgi of Wavlink WL-WN579A3 v1.0 allows attackers to execute arbitrary commands via a crafted input...

Malicious code in firewall-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 92cc8ed6f0d570590a25cc6c93d064bebfa016cbcfaff77af986af49bfcda624 The OpenSSF Package Analysis project identified 'firewall-node' @ 100.101.1337 npm as malicious. It is considered malicious because: - The packa...

MAL-2025-4049 Malicious code in firewall-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 92cc8ed6f0d570590a25cc6c93d064bebfa016cbcfaff77af986af49bfcda624 The OpenSSF Package Analysis project identified 'firewall-node' @ 100.101.1337 npm as malicious. It is considered malicious because: - The packa...

PT-2025-22301 · Wavlink · Wavlink Wl-Wn579A3

Name of the Vulnerable Software and Affected Versions: Wavlink WL-WN579A3 version 1.0 Description: A command injection vulnerability in the component /cgi-bin/firewall.cgi allows attackers to execute arbitrary commands via a crafted input. This issue affects the /cgi-bin/firewall.cgi endpoint,...

CVE-2025-44882

A command injection vulnerability in the component /cgi-bin/firewall.cgi of Wavlink WL-WN579A3 v1.0 allows attackers to execute arbitrary commands via a crafted input...

PT-2026-6292

Name of the Vulnerable Software and Affected Versions Langroid versions prior to 0.59.32 Description Langroid is a framework used for building applications powered by large-language-models. A weakness exists in the TableChatAgent component where the Web Application Firewall WAF can be bypassed...

Astra Linux – Vulnerability in Erlang

Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20, a SSH server might allow an attacker to perform unauthenticated remote code execution RCE. By exploiting a flaw in the SSH protocol’s message handling, a malicious...

A week in security (May 12 – May 18)

Last week on Malwarebytes Labs: Data broker protection rule quietly withdrawn by CFPB Meta sent cease and desist letter over AI training Google to pay $1.38 billion over privacy violations Android users bombarded with unskippable ads Last week on ThreatDown: ThreatDown introduces Firewall...

The vulnerability of the UserGate Next-Generation Firewall (NGFW), which is managed by the UserGate Management Center (UGMC), along with the UserGate Log Analyzer (LogAn), UserGate Security Information and Event Management (SIEM), arises due to insufficient security checks on the protected connection. This allows attackers to execute arbitrary operating system commands.

The vulnerability of the UserGate Next-Generation Firewall NGFW, which is managed by the UserGate Management Center UGMC, the log collection system UserGate Log Analyzer LogAn, and the UserGate Security Information and Event Management SIEM system, is related to insufficient security checks for...

MCP Guardian: a Security-First Layer for Safeguarding MCP-Based AI System

As Agentic AI gain mainstream adoption, the industry invests heavily in model capabilities, achieving rapid leaps in reasoning and quality. However, these systems remain largely confined to data silos, and each new integration requires custom logic that is difficult to scale. The Model Context...

CVE-2025-4747

A vulnerability was found in Bohua NetDragon Firewall 1.0 and classified as critical. This issue affects some unknown processing of the file /systemstatus/ipstatus.php. The manipulation of the argument subnet leads to command injection. The attack may be initiated remotely. The exploit has been...

CVE-2025-0130

A missing exception check in Palo Alto Networks PAN-OS® software with the web proxy feature enabled allows an unauthenticated attacker to send a burst of maliciously crafted packets that causes the firewall to become unresponsive and eventually reboot. Repeated successful attempts to trigger this...

CVE-2025-4747

A vulnerability was found in Bohua NetDragon Firewall 1.0 and classified as critical. This issue affects some unknown processing of the file /systemstatus/ipstatus.php. The manipulation of the argument subnet leads to command injection. The attack may be initiated remotely. The exploit has been...

CVE-2025-4747

CVE-2025-4747 affects Bohua NetDragon Firewall 1.0. The issue arises in /systemstatus/ip_status.php where manipulating the subnet argument enables command injection via a remote attack. Multiple sources confirm the vulnerability, with CVSS metrics indicating network-based access and low attack co...

CVE-2025-4747 Bohua NetDragon Firewall ip_status.php command injection

A vulnerability was found in Bohua NetDragon Firewall 1.0 and classified as critical. This issue affects some unknown processing of the file /systemstatus/ipstatus.php. The manipulation of the argument subnet leads to command injection. The attack may be initiated remotely. The exploit has been...

CVE-2025-4747 Bohua NetDragon Firewall ip_status.php command injection

A vulnerability was found in Bohua NetDragon Firewall 1.0 and classified as critical. This issue affects some unknown processing of the file /systemstatus/ipstatus.php. The manipulation of the argument subnet leads to command injection. The attack may be initiated remotely. The exploit has been...

The vulnerability of the setMacQos function in the /lib/cste_modules/firewall.so module of the TOTOLINK A3100R router’s software allows a attacker to cause a service failure.

The vulnerability of the setMacQos function in the /lib/cstemodules/firewall.so module of the TOTOLINK A3100R router’s software is related to buffer overflows in the stack when processing the priority parameter. Exploiting this vulnerability can allow an attacker to cause service interruptions by...

PT-2025-21605 · Netdragon · Bohua Netdragon Firewall

Name of the Vulnerable Software and Affected Versions: Bohua NetDragon Firewall version 1.0 Description: A critical issue affects the processing of the file /systemstatus/ip status.php. The manipulation of the subnet argument leads to command injection. The attack may be initiated remotely. The...

Bohua NetDragon Firewall 注入漏洞

Bohua NetDragon Firewall is a firewall from Bohua. An injection vulnerability exists in Bohua NetDragon Firewall version 1.0, which stems from improper handling of the parameter subnet in the file /systemstatus/ipstatus.php, which could lead to command injection...