PT-2024-5353 · Securepoint · Securepoint Utm

Published 2024-06-21 · Updated 2024-09-23 · CVE-2024-39340

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Securepoint UTM versions 11.5 through 12.6.4 Securepoint UTM Reseller Preview version 12.7.0

Description The issue is related to the authentication system of Securepoint UTM, specifically with the handling of One-Time Password (OTP) keys. This allows an attacker to bypass second-factor verification when OTP is enabled, affecting both the administration web interface and the user portal.

Recommendations For Securepoint UTM versions 11.5 through 12.6.4, update to version 12.6.5 or later to resolve the issue. For Securepoint UTM Reseller Preview version 12.7.0, update to version 12.7.1 or later to resolve the issue.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

BDU:2024-05986

CVE-2024-39340

Affected Products

Securepoint Utm

References · 10

• https://bdu.fstec.ru/vul/2024-05986 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-39340 · Security Note
• https://wiki.securepoint.de/UTM/AUTH/OTP · Note
• https://securepoint.de/en/for-companies/utm-firewall · Note
• https://wiki.securepoint.de/Advisory/CVE-2024-39340 · Note
• https://vuldb.com/ru/?id.271249 · Note
• https://t.me/cvenotify/95659 · Telegram Post
• https://t.me/cvenotify/86001 · Telegram Post
• https://t.me/cvenotify/86286 · Telegram Post
• https://wiki.securepoint.de/UTM/Changelog · Note