CVE Vulnerability Advisory Database

[Affected Scope] Cisco ASA and FTD Software with Remote Access SSL VPN enabled and secondary authentication configured.

[Impact] Unauthenticated remote attackers can trigger an unexpected device reload, leading to a complete Denial of Service (DoS) of VPN services.

[Mitigation] Apply the latest security patches from Cisco immediately; review secondary authentication configurations if patching is delayed.

[Affected Scope] Cisco Secure Firewall ASA and FTD Software with Remote Access SSL VPN service enabled

[Impact] Unauthenticated, remote attackers can cause an unexpected device reload, leading to a complete Denial of Service (DoS) condition

[Mitigation] Immediately upgrade to the patched software versions recommended in the Cisco Security Advisory

[Affected Scope] Citrix NetScaler ADC and NetScaler Gateway appliances configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server

[Impact] Unauthenticated remote attackers can trigger a memory overflow, leading to unpredictable behavior, Denial of Service (DoS), or potential Remote Code Execution (RCE)

[Mitigation] Immediately apply the official security patches provided by Citrix and restrict external access to affected virtual servers

[Affected Scope] FortiOS versions 6.0 through 7.4.2 and FortiProxy versions 1.0 through 7.4.2 with SSL-VPN service enabled

[Impact] Unauthenticated remote attackers can execute arbitrary code or commands on the target system via specially crafted HTTP requests

[Mitigation] Immediately upgrade to the patched firmware versions, or disable the SSL-VPN service as a temporary workaround

[Affected Scope] SonicWall SMA100 series (SMA 200, 210, 400, 410, 500v) running firmware versions 10.2.1.11-63sv and below.

[Impact] A remote authenticated attacker with administrative privileges can inject arbitrary OS commands via the management interface, executing them with 'nobody' user privileges.

[Mitigation] Immediately upgrade the SMA100 firmware to the patched version (10.2.1.12-65sv or higher) and restrict access to the management interface.

[Affected Scope] FortiOS versions 7.2.4 and below, 7.0.11 and below, 6.4.12 and below, 6.0.16 and below; FortiProxy versions 7.2.3 and below, 7.0.9 and below, 2.0.12 and below, and all 1.2/1.1 versions with SSL-VPN enabled

[Impact] An unauthenticated remote attacker can execute arbitrary code or commands with root privileges on the target appliance via specifically crafted HTTP requests

[Mitigation] Immediately upgrade FortiOS and FortiProxy to the patched versions, or disable the SSL-VPN service as a temporary workaround

[Affected Scope] Array Networks Array AG Series and vxAG virtual appliances running version 9.4.0.481 and earlier

[Impact] Unauthenticated remote attackers can browse the filesystem of the SSL VPN gateway by manipulating the 'flags' attribute in HTTP headers, leading to full Remote Code Execution (RCE)

[Mitigation] Immediately upgrade to the patched firmware version released by the vendor, and restrict access to the management interface and VPN ports from untrusted networks

[Affected Scope] FortiOS versions 7.2.0 to 7.2.2, 7.0.0 to 7.0.8, 6.4.0 to 6.4.10, 6.2.0 to 6.2.11, 6.0.15 and earlier; FortiProxy versions 7.2.0 to 7.2.1, 7.0.7 and earlier

[Impact] An unauthenticated remote attacker can execute arbitrary code or commands with root privileges on the target system by sending specifically crafted HTTP/HTTPS requests

[Mitigation] Immediately upgrade to the patched firmware versions or disable the SSL-VPN service and restrict access using local-in policies if patching is delayed

[Affected Scope] Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers

[Impact] Unauthenticated remote attackers can execute arbitrary code with root privileges or cause a complete system compromise via the SSL VPN gateway

[Mitigation] Immediately upgrade to the latest patched firmware versions provided by Cisco, and restrict access to the SSL VPN port from untrusted networks

[Affected Scope] SonicWall SMA100 appliances running firmware build version 10.x

[Impact] Unauthenticated remote attackers can execute arbitrary SQL queries to retrieve usernames, passwords, and active session information, leading to complete device compromise

[Mitigation] Immediately upgrade the SMA100 firmware to version 10.2.0.5 or higher to apply official security patches

[Affected Scope] Pulse Connect Secure (PCS) versions prior to 9.1R8.2 admin web interface

[Impact] An authenticated administrator-level attacker can upload a malicious custom template to execute arbitrary system commands and fully compromise the VPN gateway

[Mitigation] Immediately upgrade Pulse Connect Secure to version 9.1R8.2 or higher, and restrict external access to the admin interface

[Affected Scope] SSL VPN service running on FortiOS 6.4.0, 6.2.0 to 6.2.3, and 6.0.9 and below

[Impact] Attackers can bypass the second-factor authentication (FortiToken) and gain unauthorized access to the internal network by altering the case of the username

[Mitigation] Immediately upgrade FortiOS to the patched versions (6.4.1, 6.2.4, 6.0.10 or higher) and audit SSL VPN access logs

[Affected Scope] FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.8, 5.4.1 to 5.4.10, and FortiProxy 1.0/1.1/1.2/2.0 series

[Impact] An unauthenticated remote attacker can modify the password of any SSL VPN web portal user via specially crafted HTTP requests, leading to unauthorized network access

[Mitigation] Immediately upgrade the firmware to the patched versions, or restrict/disable the SSL VPN web portal service as a temporary workaround

[Affected Scope] Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.3 to 5.6.7, 5.4.6 to 5.4.12, and specific FortiProxy versions with SSL VPN web portal enabled

[Impact] Unauthenticated remote attackers can download arbitrary system files (including active session credentials) via specially crafted HTTP requests, leading to full network compromise

[Mitigation] Immediately upgrade FortiOS/FortiProxy firmware to the patched versions, terminate active SSL VPN sessions, and enforce a global password reset

[Affected Scope] FortiOS versions 6.0.0 through 6.0.4, 5.6.0 through 5.6.10, 5.4.0 through 5.4.12, 5.2.14 and earlier, and FortiProxy versions 2.0.0, 1.2.8 and earlier with SSL VPN web portal enabled

[Impact] Remote attackers can trigger a heap buffer overflow by forcing the proxy to process malicious javascript href data, leading to the termination of the SSL VPN web service and disconnection of active user sessions

[Mitigation] Immediately upgrade FortiOS and FortiProxy firmware to patched versions, or temporarily disable the SSL VPN web portal feature and restrict access to trusted source IPs

[Affected Scope] Pulse Connect Secure (PCS) versions prior to 8.2R12.1, 8.3R7.1, and 9.0R3.4

[Impact] An unauthenticated remote attacker can send a specially crafted URI to read arbitrary system files and session databases, potentially leading to complete credential theft and network compromise.

[Mitigation] Immediately upgrade to the official patched firmware versions (8.2R12.1, 8.3R7.1, 9.0R3.4, or later).

[Affected Scope] Pulse Connect Secure (versions prior to 9.0R3.4, 8.3R7.1, 8.2R12.1, 8.1R15.1) and Pulse Policy Secure (versions prior to 9.0R3.2, 5.4R7.1, 5.3R12.1, 5.2R12.1, 5.1R15.1)

[Impact] An authenticated attacker with administrative privileges can inject and execute arbitrary OS commands via the admin web interface, leading to complete compromise of the VPN appliance.

[Mitigation] Immediately upgrade to the patched firmware versions provided by the vendor and restrict external access to the admin interface.