Vulnerability Intelligence Report
CVE-2023-22620
An issue was discovered in SecurePoint UTM before 12.2.5.1. The firewall's endpoint at /spcgi.cgi allows sessionid information disclosure via an invalid authentication attempt. This can afterwards be used to bypass the device's authentication and get access to the administrative interface.
Nuclei Template
CVSS Base Score
7.5
HIGH
Exploitability:1.7
Impact Score:5.9
EPSS Probability:3.89%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-863 ↗CWE-863 Incorrect Authorization
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| securepoint | unified_threat_management | all |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | MITRE Corporation · N/A · USA |
| Reserved | 2023-01-04T00:00:00 |
| Published | 2023-04-12T00:00:00 |
| Last Updated | 2025-02-13T16:43:54 |
Community Chatter & Buzz