PT-2007-5024 · Esoft · Esoft Instagate Ex2 Utm

Published 2007-07-15 · Updated 2024-08-07 · CVE-2007-3786

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions eSoft InstaGate EX2 UTM device versions prior to 3.1.20070615

Description A cross-site request forgery (CSRF) issue allows remote attackers to perform privileged actions as administrators. The vendor disputes the distribution of the vulnerable software, stating it was a custom build for a former customer.

Recommendations For versions prior to 3.1.20070615, update the firmware to version 3.1.20070615 or later to resolve the issue. As a temporary workaround, consider restricting access to the device's administrative interface to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2007-3786

Affected Products

Esoft Instagate Ex2 Utm

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2007-3786 · Security Note
• http://labs.calyptix.com/CX-2007-05.txt · Vendor Advisory
• http://labs.calyptix.com/CX-2007-05.php · Vendor Advisory
• http://eweek.com/article2/0%2C1759%2C2154646%2C00.asp · Note
• http://osvdb.org/38174 · Note
• https://t.me/cvenotify/89683 · Telegram Post
• https://exchange.xforce.ibmcloud.com/vulnerabilities/35372 · Note
• http://vupen.com/english/advisories/2007/2539 · Note
• http://secunia.com/advisories/26005 · Note
• http://securityfocus.com/archive/1/473663/100/0/threaded · Note