CVE-2021-30648: broadcom symantec_advanced_secure_gateway_500-10_firmware Improper Authentication
Vulnerability summary
CVE-2021-30648 is a critical (CVSS 9.8) Improper Authentication vulnerability in broadcom symantec_advanced_secure_gateway_500-10_firmware. EPSS estimates a 1.45% chance of exploitation in the next 30 days, higher than 72.8% of scored vulnerabilities.
Timeline
- 30-06-2021PublishedVulnerability first disclosed.
- 03-08-2024Last modifiedVulnerability information updated.
Description
The Symantec Advanced Secure Gateway (ASG) and ProxySG web management consoles are susceptible to an authentication bypass vulnerability. An unauthenticated attacker can execute arbitrary CLI commands, view/modify the appliance configuration and policy, and shutdown/restart the appliance.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
1.45%
Chance of exploitation in the next 30 days
Percentile
73%
Versus all other CVEs
30-day change
0.00 pp
From 1.45% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Broadcom8 products
- symantec_advanced_secure_gateway_500-10_firmware≥ 6.6, < 6.7.4.17 | ≥ 6.7.5.0, < 6.7.5.12 | ≥ 7.2, < 7.2.7.2 | ≥ 7.3, < 7.3.3.3
- symantec_advanced_secure_gateway_s200-30_firmware≥ 6.6, < 6.7.4.17 | ≥ 6.7.5.0, < 6.7.5.12 | ≥ 7.2, < 7.2.7.2 | ≥ 7.3, < 7.3.3.3
- symantec_advanced_secure_gateway_s200-40_firmware≥ 6.6, < 6.7.4.17 | ≥ 6.7.5.0, < 6.7.5.12 | ≥ 7.2, < 7.2.7.2 | ≥ 7.3, < 7.3.3.3
- symantec_advanced_secure_gateway_s400-20_firmware≥ 6.6, < 6.7.4.17 | ≥ 6.7.5.0, < 6.7.5.12 | ≥ 7.2, < 7.2.7.2 | ≥ 7.3, < 7.3.3.3
- symantec_advanced_secure_gateway_s400-30_firmware≥ 6.6, < 6.7.4.17 | ≥ 6.7.5.0, < 6.7.5.12 | ≥ 7.2, < 7.2.7.2 | ≥ 7.3, < 7.3.3.3
1 vendor · 8 products
References
1 links- support.broadcom.com/security-advisory/content/security-advisories/0/SYMSA18331X Refsource MISCVendor Advisory