CVE-2007-4422: Symantec Enterprise Firewall

High severity, CVSS 9.3. EPSS: 2.6% chance of exploitation in the next 30 days.

The login interface in Symantec Enterprise Firewall 6.x, when a VPN with pre-shared key (PSK) authentication is enabled, generates different responses depending on whether or not a username is valid, which allows remote attackers to enumerate valid usernames.

Affected products

• Symantec Enterprise Firewall: version 6 only

Published 2007-08-18. Last modified 2026-06-16.