Z3Er01

Name of the Vulnerable Software and Affected Versions: GFI Kerio Control version 9.4.5 Description: An authentication bypass issue exists due to insecure default proxy configuration and weak access control in the GFIAgent service. The non-transparent proxy on TCP port 3128 can be used to forward unauthenticated requests to internal services, bypassing firewall restrictions and exposing internal management endpoints. This enables unauthenticated attackers to access the GFIAgent service on ports 7995 and 7996, retrieve the appliance UUID, and issue administrative requests via the proxy. Exploitation results in full administrative access to the Kerio Control appliance. Recommendations: For GFI Kerio Control version 9.4.5, consider disabling the non-transparent proxy on TCP port 3128 as a temporary workaround to prevent exploitation. Restrict access to the GFIAgent service on ports 7995 and 7996 to minimize the risk of unauthorized access. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: GFI Kerio Control version 9.4.5 Description: A remote code execution issue allows attackers with administrative access to upload and execute arbitrary code through the firmware upgrade feature. The system upgrade mechanism accepts unsigned .img files, which can be modified to include malicious scripts within the `upgrade.sh` or disk image components. These modified upgrade images are not validated for authenticity or integrity and are executed by the system post-upload, enabling root access. Recommendations: For GFI Kerio Control version 9.4.5, consider disabling the firmware upgrade feature until a patch is available to prevent the upload and execution of arbitrary code. Restrict access to the system upgrade mechanism to minimize the risk of exploitation. Avoid using unsigned .img files in the firmware upgrade feature until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: GFI Kerio Control version 9.4.5 Description: A missing authentication vulnerability in the GFIAgent component allows unauthenticated remote attackers to perform privileged operations. The GFIAgent service exposes HTTP services on ports 7995 and 7996 without proper authentication. The "/proxy" handler on port 7996 allows arbitrary forwarding to administrative endpoints when provided with an `Appliance UUID`, which can be retrieved from port 7995. This results in a complete authentication bypass, permitting access to sensitive administrative APIs. Recommendations: For GFI Kerio Control version 9.4.5, consider disabling the GFIAgent service or restricting access to ports 7995 and 7996 until a patch is available. As a temporary workaround, avoid using the `/proxy` handler on port 7996 to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.