CVE-2022-25291

Опубликовано: 24 фев. 2022

Источник: nvd

CVSS3: 8.8

CVSS2: 6.5

EPSS Низкий

Описание

An integer overflow in WatchGuard Firebox and XTM appliances allows an authenticated remote attacker to trigger a heap-based buffer overflow and potentially execute arbitrary code by initiating a firmware update with a malicious upgrade image. This vulnerability impacts Fireware OS before 12.7.2_U2, 12.x before 12.1.3_U8, and 12.2.x through 12.5.x before 12.5.9_U2.

Ссылки

https://www.watchguard.com/support/release-notes/fireware/12/en-US/EN_ReleaseNotes_Fireware_12_7_2/index.html#Fireware/en-US/resolved_issues.html
Release Notes
Vendor Advisory
https://www.watchguard.com/support/release-notes/fireware/12/en-US/EN_ReleaseNotes_Fireware_12_7_2/index.html#Fireware/en-US/resolved_issues.html
Release Notes
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:*

Версия от 12.0.0 (включая) до 12.1.3 (исключая)

cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:*

Версия от 12.2.0 (включая) до 12.5.9 (исключая)

cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:*

Версия от 12.7.0 (включая) до 12.7.2 (исключая)

cpe:2.3:o:watchguard:fireware:12.1.3:-:*:*:*:*:*:*

cpe:2.3:o:watchguard:fireware:12.1.3:u1:*:*:*:*:*:*

cpe:2.3:o:watchguard:fireware:12.1.3:u2:*:*:*:*:*:*

cpe:2.3:o:watchguard:fireware:12.1.3:u3:*:*:*:*:*:*

cpe:2.3:o:watchguard:fireware:12.1.3:u4:*:*:*:*:*:*

cpe:2.3:o:watchguard:fireware:12.1.3:u5:*:*:*:*:*:*

cpe:2.3:o:watchguard:fireware:12.1.3:u6:*:*:*:*:*:*

cpe:2.3:o:watchguard:fireware:12.1.3:u7:*:*:*:*:*:*

cpe:2.3:o:watchguard:fireware:12.5.9:-:*:*:*:*:*:*

cpe:2.3:o:watchguard:fireware:12.5.9:u1:*:*:*:*:*:*

cpe:2.3:o:watchguard:fireware:12.7.2:-:*:*:*:*:*:*

cpe:2.3:o:watchguard:fireware:12.7.2:u1:*:*:*:*:*:*

EPSS

Процентиль: 83%

0.01923

Низкий

8.8 High

CVSS3

6.5 Medium

CVSS2

Дефекты

CWE-190

Связанные уязвимости

GHSA-jg8f-6gxm-7343

github

почти 4 года назад

EPSS

Процентиль: 83%

0.01923

Низкий

8.8 High

CVSS3

6.5 Medium

CVSS2

Дефекты

CWE-190