Security Director EUVD-2025-21158

This vulnerability presents HIGH real-world risk despite requiring authenticated access. CVSS 9.6 reflects: Network-based attack vector (AV:N), Low attack complexity (AC:L), but importantly Requires authenticated credentials (PR:L). The CVSS indicates HIGH impact to Confidentiality (C:H—sensitive data disclosure), HIGH impact to Integrity (I:H—tampering with resources), and POTENTIAL impact to Availability (A:H through downstream device manipulation). The combination of an authenticated attacker with access to configuration modification across multiple endpoints creates a SEVERE privilege escalation risk. While requiring PR:L reduces the attack surface compared to unauthenticated vulnerabilities, any authenticated user (including low-privileged administrative accounts, API service accounts, or externally provisioned users) can exploit this to access admin-level data. The fact that downstream managed devices can be impacted elevates this beyond the Security Director itself. This is a CRITICAL PRIORITY issue for organizations running affected versions, particularly in zero-trust or multi-tenant environments where user privilege boundaries are security-critical.

An authenticated administrative user with limited privileges (e.g., a junior security engineer with read-only permissions for a specific region) logs into the Security Director web interface. Due to missing authorization checks, they craft HTTP API requests to access confidential endpoints such as device credentials, firewall ruleset configurations, or VPN encryption keys normally restricted to senior administrators. They successfully retrieve sensitive data due to insufficient endpoint authorization validation. Alternatively, a disgruntled employee or compromised low-privilege service account (API token for automation) makes requests to modify device policies or administrator account settings on downstream firewalls, causing widespread network disruption. No exploit code is required—standard HTTP requests to predictable API endpoints (e.g., /api/admin/credentials without privilege validation) are sufficient. The PR:L requirement means this is not worm-capable but poses severe risk in insider threat and lateral privilege escalation scenarios.