The authentication system of Securepoint UTM mishandles OTP keys. This allows the bypassing of second-factor verification (when OTP is enabled) in both the administration web interface and the user portal. Affected versions include UTM 11.5 through 12.6.4 and Reseller Preview 12.7.0. The issue has been fixed in UTM 12.6.5 and 12.7.1.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Securepoint |
|
No data.
No data.
References
History
Mon, 23 Sep 2024 15:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Securepoint
Securepoint unified Threat Management |
|
| CPEs | cpe:2.3:o:securepoint:unified_threat_management:*:*:*:*:*:*:*:* | |
| Vendors & Products |
Securepoint
Securepoint unified Threat Management |
|
| Metrics |
ssvc
|
Mon, 23 Sep 2024 15:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | A security vulnerability has been discovered in the handling of OTP keys in the authentication system of Securepoint UTM. This vulnerability allows the bypassing of second-factor verification (when OTP is enabled) in both the administration web interface and the user portal. Affected versions include UTM 11.5 to 12.6.4 and the Reseller Preview version 12.7.0. The issue has been fixed in UTM versions 12.6.5 and 12.7.1. | The authentication system of Securepoint UTM mishandles OTP keys. This allows the bypassing of second-factor verification (when OTP is enabled) in both the administration web interface and the user portal. Affected versions include UTM 11.5 through 12.6.4 and Reseller Preview 12.7.0. The issue has been fixed in UTM 12.6.5 and 12.7.1. |
| References |
|
MITRE
Status: PUBLISHED
Assigner: mitre
Published: 2024-07-12T00:00:00
Updated: 2024-09-23T14:52:47.331492
Reserved: 2024-06-24T00:00:00
Link: CVE-2024-39340
Vulnrichment
Updated: 2024-08-02T04:26:14.259Z
NVD
Status : Awaiting Analysis
Published: 2024-07-12T13:15:12.057
Modified: 2024-11-21T09:27:30.070
Link: CVE-2024-39340
Redhat
No data.