title: Remote Code Execution Vulnerability in Tacitine Firewall
description: This vulnerability exists in Tacitine Firewall, all versions of EN6200-PRIME QUAD-35 and EN6200-PRIME QUAD-100 between 19.1.1 to 22.20.1 (inclusive), due to improper control of code generation in the Tacitine Firewall web-based management interface. An unauthenticated remote attacker could exploit this vulnerability by sending a specially crafted http request on the targeted device. Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to execute arbitrary commands on the targeted device.
problem types: CWE-94 Improper Control of Generation of Code ('Code Injection')
affected:
{
product: Firewall
vendor: Tacitine
versions:
lessThan: EN6200-PRIME QUAD-35*, status: affected, version: 19.1.1, versionType: custom
lessThan: EN6200-PRIME QUAD-100*, status: affected, version: 19.1.1, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
]
solutions: Update Tacitine Firewall to latest software version 22.21.2