vendor:
UTM 9
by:
KoreLogic
7.2
CVSS
HIGH
Privilege Escalation
306
CWE
Product Name: UTM 9
Affected Version From: 9.410
Affected Version To: 9.410
Patch Exists: NO
Related CWE: N/A
CPE: a:sophos:utm_9
Metasploit:
N/A
Other Scripts:
N/A
Platforms Tested: Embedded Linux
2018
Sophos UTM 9 loginuser Privilege Escalation via confd Service
The attacker must know the password for the loginuser account. The confd client is not available to the loginuser account. However, the running service is accessible over a network port on the loopback interface. By replaying the network traffic required to obtain a SID from this service it is possible to escalate privileges to root.
Mitigation:
Ensure that the loginuser account is not used for privileged access and that the password is changed regularly.
