|
[Japanese]
|
JVNDB-2026-000148
|
SiteGuard Server Edition vulnerable to OS command injection
|
|
SiteGuard Server Edition provided by EG Secure Solutions Inc. is a host-based Web Application Firewall (WAF) designed to be integrated into a web server. The statistics feature of SiteGuard Server Edition contains the following vulnerability:
- OS command injection (CWE-78) - CVE-2026-106931
Note that the vulnerability has been confirmed to be exploited in the wild.
The developer reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
|
|
CVSS V3 Severity:
Base Metrics 7.8 (High) [IPA Score]
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
|
CVSS v4 Severity
Base Metrics: 8.5 (High) [IPA Score]
- Access Vector (AV): Local
- Attack Complexity (AC): Low
- Attack Requirements (AT): None
- Privileges Required (PR): Low
- User Interaction (UI): None
Vulnerable System Impact
- Confidentiality Impact (VC): High
- Integrity Impact (VI): High
- Availability Impact (VA): High
Subsequent System Impact
- Confidentiality Impact (SC): None
- Integrity Impact (SI): None
- Availability Impact (SA): None
|
|
|
EG Secure Solutions Inc.
- SiteGuard Server Edition Ver2.20 and later versions
|
- For IIS: versions from Ver3.10 to Ver4.00 Update 4 are not affected.
The product is affected by this vulnerability when the statistics feature is enabled. The feature is enabled by default.
|
|
An attacker may be able to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product.
|
|
[Update the Software]
Update the software to the latest version according to the information provided by the developer.
This vulnerability has been fixed in the following versions: - For Apache httpd, Nginx, IIS: Ver8.00 Update 5
- For Apache httpd and Nginx on FreeBSD: Ver7.00 Update 6
[Apply the patch]
For users who are unable to upgrade, the developer provides a patch that replaces the files used in statistical processing. The patch is available even for end-of-life (EOL) versions.
The developer notified customers with direct support contracts of this vulnerability and the available countermeasures on September 29, 2026.
For more details, refer to the information provided by the developer.
|
|
EG Secure Solutions Inc.
|
|
- OS Command Injection(CWE-78) [IPA Evaluation]
|
|
- CVE-2026-106931
|
|
- JVN : JVN#88474777
- JPCERT Alert : JPCERT-AT-2026-0032 (in Japanese)
|
|
- [2026/10/14]
Web page was published
|
