Vulnerability in Seil B1

CVE-2012-2632

SEIL routers with firmware SEIL/x86 1.00 through 2.35, SEIL/X1 2.30 through 3.75, SEIL/X2 2.30 through 3.75, and SEIL/B1 2.30 through 3.75, when the http-proxy and application-gateway features are enabled, do not properly handle the CONNECT command, which allows remote attackers to bypass intended URL restrictions via a TCP session.

EPSS: 0.012 (65.4th percentile) — read the EPSS interpretation.

Affected products

Seil B1 — versions 2.30, 2.40, 2.41
Seil B1_firmware — versions 2.30, 2.40, 2.41
Seil X1 — versions 2.30, 2.40, 2.41
Seil X2 — versions 2.30, 2.40, 2.41
Seil X86_firmware — versions 1.00, 1.61
N/a — versions n/a

References

vultures@jpcert.or.jp (x_refsource_JVNDB, third-party-advisory)
vultures@jpcert.or.jp (x_refsource_JVN, third-party-advisory)
vultures@jpcert.or.jp (x_refsource_CONFIRM, Vendor Advisory)