CVE-2021-33600: f-secure f-secure internet gatekeeper Reachable Assertion

Vulnerability summary

CVE-2021-33600 is a high (CVSS 7.5) Reachable Assertion vulnerability in f-secure f-secure internet gatekeeper. EPSS estimates a 0.61% chance of exploitation in the next 30 days, higher than 48% of scored vulnerabilities.

Timeline

1. 28-09-2021
   PublishedVulnerability first disclosed.
2. 03-08-2024
   Last modifiedVulnerability information updated.

Description

A denial-of-service (DoS) vulnerability was discovered in the web user interface of F-Secure Internet Gatekeeper. The vulnerability occurs because of an attacker can trigger assertion via malformed HTTP packet to web interface. An unauthenticated attacker could exploit this vulnerability by sending a large username parameter. A successful exploitation could lead to a denial-of-service of the product.

• CWE-617Reachable AssertionThe product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.