A vulnerability was found in Aep Networks Smartgate Ssl Server 4.3b. It has been rated as problematic. This issue affects some unknown functionality. The manipulation with an unknown input leads to a information disclosure vulnerability. Using CWE to declare the problem leads to CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. Impacted is confidentiality. The summary by CVE is:

The SSL server in AEP Smartgate 4.3b allows remote attackers to determine existence of directories via a direct request for a directory URI, which returns different HTTP status codes for existing and non-existing directories.

The weakness was shared 11/03/2006 (Website). It is possible to read the advisory at secunia.com. The identification of this vulnerability is CVE-2006-5725 since 11/03/2006. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details are unknown but a public exploit is available. The attack technique deployed by this issue is T1592 according to MITRE ATT&CK.

The exploit is available at exploit-db.com. It is declared as proof-of-concept.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the databases at X-Force (29802), Exploit-DB (2637) and Secunia (SA22550†). The entry VDB-33018 is related to this item.

Productinfo

Vendor

• Aep Networks

Name

• Smartgate Ssl Server

Version

• 4.3b

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion