Improper input validation in Watchguard Legacy Rssa
CVE-2002-1979
WatchGuard SOHO products running firmware 5.1.6 and earlier, and Vclass/RSSA using 3.2 SP1 and earlier, allows remote attackers to bypass firewall rules by sending a PASV command string as the argument of another command to an FTP server, which generates a response that contains the string, causing IPFilter to treat the response as if it were a legitimate PASV command from the server.
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
EPSS: 0.015 (72.4th percentile) — read the EPSS interpretation.
Affected products
- Watchguard Legacy_rssa
- Watchguard Soho
- Watchguard Vclass
- N/a — versions n/a
Weakness classification (CWE)
References
- cve@mitre.org (x_refsource_CONFIRM, Patch)
- cve@mitre.org (US Government Resource, x_refsource_CERT-VN, third-party-advisory)