CVE-2023-22897: Securepoint Unified Threat Management

Medium severity, CVSS 6.5. EPSS: 4.1% chance of exploitation in the next 30 days.

An issue was discovered in SecurePoint UTM before 12.2.5.1. The firewall's endpoint at /spcgi.cgi allows information disclosure of memory contents to be achieved by an authenticated user. Essentially, uninitialized data can be retrieved via an approach in which a sessionid is obtained but not used.

Affected products

• Securepoint Unified Threat Management: from 12.2.3.1, before 12.2.5.1 (fixed in 12.2.5.1)

Published 2023-04-12. Last modified 2026-06-17.