Critical Flaws Found in Cyberoam Security Devices

guest · May 15, 2020

Critical Flaws Found in Cyberoam Security Devices
May 14, 2020
https://www.infosecurity-magazine.com/news/critical-flaws-found-in-cyberoam/

Critical flaws have been discovered in a cybersecurity company's next-generation firewall and VPN technology.

Researchers at vpnMentor detected two vulnerabilities in cybersecurity devices developed by Cyberoam Technologies.
The first vulnerability was found in the FirewallOS of Cyberoam SSL VPNs in the last quarter of 2019, while the second was shared with vpnMentor by an anonymous ethical hacker at the beginning of 2020 and verified at vpnMentor's Research Lab.

"After confirming their findings, our team discovered a third flaw, which had also gone unnoticed," wrote researchers.
Cyberoam software works by forming a gateway that blocks unauthorized access to a network. Researchers revealed that the main flaw in Cyberoam’s security involved two separate weaknesses in how an email is "released from quarantine" on a Cyberoam device.
Click to expand...

"Both unrelated issues could have been used to give hackers access to Cyberoam’s devices, and, as an end result, make it easier to exploit any device which their firewalls were guarding," wrote researchers.
Hotfixes have been published by Sophos to resolve the vulnerabilities, which are not the first flaws to be discovered in Cyberoam's security products.
Click to expand...

vpnMentor: Report: Critical Flaws in Cybersecurity Devices Exposed Entire Networks to Attack and Takeover

The First Vulnerability: Unauthenticated Root Remote Command Execution (pre-auth RCE)
The Second Vulnerability: Unauthenticated Root Remote Command Execution (pre-auth RCE)
Hardcoded Default Login Credentials, Discovered by Nadav Voloch
How Many Networks Were at Risk?
We can’t say exactly but can give estimates.
At least 86,000 Cyberoam IP addresses are accessible via Shodan. By our estimates, the real number of potentially vulnerable systems running Cyberoam is likely much much higher. Most devices would be filtered with firewalls, won’t be caught with internet search engines, or not connected to the internet 24/7.
Click to expand...

Log in or Sign up

Critical Flaws Found in Cyberoam Security Devices

guest Guest

Log in or Sign up

Critical Flaws Found in Cyberoam Security Devices

guest Guest

Useful Searches