CVE-2021-22908

Name of the Vulnerable Software and Affected Versions Pulse Connect Secure versions 9.X through 9.1R2 Windows File Resource Profiles versions 9.X through 9.1R2

Description A buffer overflow issue exists, allowing a remote authenticated user with privileges to browse SMB shares to execute arbitrary code as the root user. The permission to browse SMB shares is not enabled by default as of version 9.1R3.

Recommendations For Pulse Connect Secure versions 9.X through 9.1R2, update to a version where this permission is not enabled by default, such as 9.1R3 or later. For Windows File Resource Profiles versions 9.X through 9.1R2, consider disabling the SMB share browsing feature until a patch is available.