CVE Vulnerability Advisory Database

[Affected Scope] Pulse Connect Secure versions prior to 9.1R11.4

[Impact] An authenticated administrator can upload a maliciously crafted archive file to write arbitrary files to the system, potentially leading to remote code execution

[Mitigation] Immediately upgrade Pulse Connect Secure to version 9.1R11.4 or higher, and restrict external access to the administrator interface

[Affected Scope] Pulse Connect Secure (PCS) versions prior to 9.1R11.4

[Impact] A remote authenticated attacker can exploit the Windows Resource Profiles feature to execute arbitrary commands with root privileges on the VPN gateway, potentially compromising the internal network

[Mitigation] Immediately upgrade Pulse Connect Secure to version 9.1R11.4 or higher, apply the official XML workaround template, and perform compromise assessment

[Affected Scope] Pulse Connect Secure versions prior to 9.1R11.4

[Impact] A remote authenticated attacker can execute arbitrary code with root privileges on the target system via a maliciously crafted meeting room.

[Mitigation] Immediately upgrade Pulse Connect Secure to version 9.1R11.4 or higher, and disable unused Meeting Room features.

[Affected Scope] Pulse Connect Secure 9.0R3/9.1R1 and higher

[Impact] Unauthenticated remote attackers can bypass authentication and execute arbitrary code with root privileges via Windows File Share Browser and Collaboration features

[Mitigation] Apply official vendor patches immediately, or import the mitigation XML workaround to disable vulnerable features

[Affected Scope] Pulse Connect Secure versions prior to 9.1R9 admin web interface

[Impact] An authenticated administrator-level attacker can execute arbitrary code with system privileges via uncontrolled gzip extraction

[Mitigation] Immediately upgrade Pulse Connect Secure to version 9.1R9 or higher and restrict external access to the admin interface

[Affected Scope] Pulse Connect Secure (PCS) versions prior to 9.1R8.2 admin web interface

[Impact] An authenticated administrator-level attacker can upload a malicious custom template to execute arbitrary system commands and fully compromise the VPN gateway

[Mitigation] Immediately upgrade Pulse Connect Secure to version 9.1R8.2 or higher, and restrict external access to the admin interface

[Affected Scope] Pulse Connect Secure versions prior to 9.1R8 admin web interface

[Impact] An authenticated attacker with administrator privileges can execute arbitrary code on the appliance by sending a specially crafted URI, leading to complete system compromise

[Mitigation] Immediately upgrade Pulse Connect Secure to version 9.1R8 or higher, and restrict external access to the admin interface

[Affected Scope] Pulse Connect Secure (PCS) versions prior to 8.2R12.1, 8.3R7.1, and 9.0R3.4

[Impact] An unauthenticated remote attacker can send a specially crafted URI to read arbitrary system files and session databases, potentially leading to complete credential theft and network compromise.

[Mitigation] Immediately upgrade to the official patched firmware versions (8.2R12.1, 8.3R7.1, 9.0R3.4, or later).

[Affected Scope] Pulse Connect Secure (versions prior to 9.0R3.4, 8.3R7.1, 8.2R12.1, 8.1R15.1) and Pulse Policy Secure (versions prior to 9.0R3.2, 5.4R7.1, 5.3R12.1, 5.2R12.1, 5.1R15.1)

[Impact] An authenticated attacker with administrative privileges can inject and execute arbitrary OS commands via the admin web interface, leading to complete compromise of the VPN appliance.

[Mitigation] Immediately upgrade to the patched firmware versions provided by the vendor and restrict external access to the admin interface.