Skip to main content
عربي
logo

NCSC-TAD-2104-003

Severity Level: Critical
Vulnerability

Reference No.: NCSC-TAD-2104-003CVSS 0

APT Actors Exploiting a Pulse Secure Flaw

Threat Type:
N/A
TLP:
CLEAR
CVE:
CVE-2021-22893, CVE-2019-11510, CVE-2020-8243, CVE-2020-8260

Overview

Threat actors who may belong to APT5 are exploiting a zero-day flaw (CVE-2021-22893) in Pulse Connect Secure SSL VPN appliances. The vulnerability allows an unauthenticated attacker to execute arbitrary code remotely by sending a specially crafted HTTP request. The activity also involves previously known vulnerabilities that allow arbitrary file reading and code execution through custom template uploads and uncontrolled gzip extraction.

Affected Technologies

  • Pulse Connect Secure SSL VPN appliances

Mitigation and Immediate Actions

  1. 01

    Pulse Secure advises customers with gateways running PCS 9.0R3 or higher to upgrade the server software to the 9.1R.11.4 release.

  2. 02

    As a temporary workaround, the vulnerability can be mitigated on some gateways by disabling Windows File Share Browser and Pulse Secure Collaboration features by importing an XML file.

References