Actively exploited · Published Apr 23, 2021 · Assigned by hackerone
CVE-2021-22893
Critical 10.0 Exploited Ransomware
In plain English
A critical-severity improper authentication in Pulse Connect Secure. Attackers are actively exploiting it in the wild (listed by CISA on November 3, 2021). It has been used in ransomware campaigns. The chance it is exploited in the next 30 days is estimated at 47.2% (higher than 99% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Apply updates per vendor instructions.
CISA guidance
Apply updates per vendor instructions.
Federal agencies must remediate by May 3, 2022.
Official description
Pulse Connect Secure 9.0R3/9.1R1 and higher is vulnerable to an authentication bypass vulnerability exposed by the Windows File Share Browser and Pulse Secure Collaboration features of Pulse Connect Secure that can allow an unauthenticated user to perform remote arbitrary code execution on the Pulse Connect Secure gateway. This vulnerability has been exploited in the wild.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | Pulse Connect Secure | PCS 9.0R3 or above, PCS 9.1R1 and above |
Weakness: CWE-287 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
References
- https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44784/ x_refsource_MISC
- https://blog.pulsesecure.net/pulse-connect-secure-security-update/ x_refsource_MISC
- https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html x_refsource_MISC
- https://kb.cert.org/vuls/id/213092 x_refsource_MISC
- https://www.kb.cert.org/vuls/id/213092
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-22893 government-resource