[Content]
Forwarded from TWCERTCC-200-202601-00000001

【Xena Networks | VPN Firewall – Insufficient Entropy】 (CVE-2025-15387, CVSS: 8.8) An Insufficient Entropy vulnerability exists in the VPN firewall. An unauthenticated remote attacker can obtain the session of any logged-in user through brute-force attacks and subsequently log into the system.

【Xena Networks | VPN Firewall – OS Command Injection】 (CVE-2025-15388, CVSS: 8.8) An OS Command Injection vulnerability exists in the VPN firewall. An authenticated remote attacker can inject arbitrary operating system commands and execute them on the server.

【Xena Networks | VPN Firewall – OS Command Injection】 (CVE-2025-15389, CVSS: 8.8) An OS Command Injection vulnerability exists in the VPN firewall. An authenticated remote attacker can inject arbitrary operating system commands and execute them on the server.

(Information Sharing Level: WHITE (Information content can be publicly disclosed)