CVE-2023-22620

An issue was discovered in SecurePoint UTM before 12.2.5.1. The firewall's endpoint at /spcgi.cgi allows sessionid information disclosure via an invalid authentication attempt. This can afterwards be used to bypass the device's authentication and get access to the administrative interface.

CVSS v3.1

7.5 HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

CVSS v3.1

7.5 HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

3.92% chance of exploitation in the next 30 days, 90th percentile

Nuclei

high · CWE-863

Published

2023-04-12

Updated

2025-02-13

Proof-of-concept exploits (3)

• http://packetstormsecurity.com/files/171924/SecurePoint-UTM-12.x-Session-ID-Leak.html
• http://seclists.org/fulldisclosure/2023/Apr/7
• MrTuxracer/advisories/blob/master/CVEs/CVE-2023-22620.txt

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-22620.yaml

References

• CVE Record
• NVD entry

Related

• CVE-2022-2536
• CVE-2022-3747
• CVE-2022-3861
• CVE-2023-22897
• CVE-2025-27889
• CVE-2025-47813