CVE-2023-22620
📋 TL;DR
This vulnerability in SecurePoint UTM firewalls allows attackers to obtain valid session IDs through invalid authentication attempts. These stolen session IDs can then be used to bypass authentication and gain administrative access to the device. Organizations running affected SecurePoint UTM versions are at risk.
💻 Affected Systems
- SecurePoint UTM
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full administrative compromise of the firewall, allowing attackers to reconfigure network security, intercept traffic, disable security controls, and use the device as a foothold for lateral movement.
Likely Case
Unauthorized administrative access leading to firewall configuration changes, network policy manipulation, and potential data interception.
If Mitigated
Limited impact with proper network segmentation, strong authentication controls, and monitoring in place to detect unauthorized access attempts.
🎯 Exploit Status
Exploitation requires sending crafted requests to the vulnerable endpoint. Public proof-of-concept code is available in the referenced advisories.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 12.2.5.1
Vendor Advisory: https://rcesecurity.com
Restart Required: Yes
Instructions:
1. Log into SecurePoint UTM admin interface. 2. Navigate to System > Update. 3. Check for available updates. 4. Apply update to version 12.2.5.1 or later. 5. Reboot the device as prompted.
🔧 Temporary Workarounds
Restrict Access to Management Interface
allLimit network access to the firewall's management interface to trusted IP addresses only.
Configure firewall rules to restrict access to port 443/TCP (HTTPS) and port 80/TCP (HTTP) to specific management IP ranges.
Disable Unnecessary Web Interface
linuxIf CLI management is sufficient, disable the web management interface.
Use SSH/CLI to disable web interface: system disable-webgui
🧯 If You Can't Patch
- Implement strict network segmentation to isolate firewall management interface from untrusted networks
- Enable multi-factor authentication if supported and monitor authentication logs for suspicious activity
🔍 How to Verify
Check if Vulnerable:
Check current version via web interface (System > Status) or CLI command 'show version'. If version is below 12.2.5.1, the system is vulnerable.Check Version:
show versionVerify Fix Applied:
After patching, verify version is 12.2.5.1 or higher. Test authentication attempts to /spcgi.cgi endpoint to ensure session IDs are no longer leaked.📡 Detection & Monitoring
Log Indicators:
- Multiple failed authentication attempts to /spcgi.cgi followed by successful authentication with different session IDs
- Administrative access from unusual IP addresses or outside maintenance windows
Network Indicators:
- Unusual HTTP requests to /spcgi.cgi endpoint with authentication parameters
- Traffic patterns suggesting session hijacking
SIEM Query:
source="securepoint-utm" AND (uri_path="/spcgi.cgi" AND (http_status=401 OR http_status=200)) | stats count by src_ip, session_id🔗 References
- http://packetstormsecurity.com/files/171924/SecurePoint-UTM-12.x-Session-ID-Leak.html
- http://seclists.org/fulldisclosure/2023/Apr/7
- https://github.com/MrTuxracer/advisories/blob/master/CVEs/CVE-2023-22620.txt
- https://rcesecurity.com
- http://packetstormsecurity.com/files/171924/SecurePoint-UTM-12.x-Session-ID-Leak.html
- http://seclists.org/fulldisclosure/2023/Apr/7
- https://github.com/MrTuxracer/advisories/blob/master/CVEs/CVE-2023-22620.txt
- https://rcesecurity.com
