CVE-2021-4470: TG8 Firewall

Critical severity, CVSS 9.3. EPSS: 1% chance of exploitation in the next 30 days.

TG8 Firewall contains a pre-authentication remote code execution vulnerability in the runphpcmd.php endpoint. The syscmd POST parameter is passed directly to a system command without validation and executed with root privileges. A remote, unauthenticated attacker can supply crafted values to execute arbitrary operating system commands as root, resulting in full device compromise.

Affected products

• TG8 TG8 Firewall: version 0 only

Published 2025-11-14. Last modified 2026-06-17.