Vulnerability identifier: #VU35775
Vulnerability risk: High
CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID:
CWE-ID:
CWE-326
Exploitation vector: Network
Exploit availability: No
Vulnerable software:
Pulse Connect Secure
Server applications /
Remote access servers, VPN
Pulse Policy Secure
Server applications /
Remote access servers, VPN
Vendor: Pulse Secure
Description
The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.
Session data between cluster nodes during cluster synchronization is not properly encrypted in Pulse Secure Pulse Connect Secure (PCS) 8.3RX before 8.3R2 and Pulse Policy Secure (PPS) 5.4RX before 5.4R2. This is not applicable to PCS 8.1RX, PPS 5.2RX, or stand-alone devices.
Mitigation
Install update from vendor's website.
Vulnerable software versions
Pulse Connect Secure: 8.3
Pulse Policy Secure: 5.4 - 8.3
External links
http://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA43877/
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.