CVE-2015-2746

Severity: medium (CVSS 6.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 25.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2015-03-26 · updated 2026-06-17
Weakness: CWE-77

Description

The network diagnostics tool (CommandLineServlet) in the Appliance Manager command line utility (CLU) in Websense TRITON 7.8.3 and V-Series appliances before 7.8.4 Hotfix 02 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the "second" parameter of a command, as demonstrated by the Destination parameter in the ping command.

Affected products

Websense Triton: 7.8.3
Websense V-Series Appliances: through 7.7

References

http://packetstormsecurity.com/files/130899/Websense-Appliance-Manager-Command-Injection.html
http://seclists.org/fulldisclosure/2015/Mar/104
http://www.securityfocus.com/archive/1/534910/100/0/threaded
http://www.websense.com/support/article/kbarticle/October-2014-Hotfix-Summary-for-Websense-Solutions
https://www.exploit-db.com/exploits/36423/
https://www.securify.nl/advisory/SFY20140906/command_injection_vulnerability_in_network_diagnostics_tool_of_websense_appliance_manager.html
http://packetstormsecurity.com/files/130899/Websense-Appliance-Manager-Command-Injection.html
http://seclists.org/fulldisclosure/2015/Mar/104
http://www.securityfocus.com/archive/1/534910/100/0/threaded
http://www.websense.com/support/article/kbarticle/October-2014-Hotfix-Summary-for-Websense-Solutions
https://www.exploit-db.com/exploits/36423/
https://www.securify.nl/advisory/SFY20140906/command_injection_vulnerability_in_network_diagnostics_tool_of_websense_appliance_manager.html

Get alerted when CVE-2015-2746 or the next vulnerability affects your stack