Absolute Security
Monthly
Unauthenticated remote attackers can cause a persistent denial of service on Absolute Secure Access servers running versions prior to 14.60 by sending specially crafted traffic to the connection setup subsystem. The flaw affects only availability (CVSS 4.0 score 8.7, CVSS 3.1 A:H), with no impact to confidentiality or integrity. A vendor patch is available in version 14.60; no public exploit code or active exploitation has been identified at time of analysis.
Persistent denial of service in Absolute Secure Access servers before 14.60 can be triggered by an authenticated remote attacker who sends malformed data to the client registration process, causing availability impact that outlasts the triggering request. The flaw requires network reachability and valid credentials, as reflected by PR:L in the vendor and independent vectors, so it is not an unauthenticated attack; no public exploit identified at time of analysis. The vendor rates it CVSS 7.1 High, while the independent assessment characterizes it as a genuine but moderate-priority availability issue because of the authentication prerequisite and availability-only impact.
Denial of service in Absolute Secure Access servers before version 14.60 allows unauthenticated remote attackers to cause a persistent outage by sending a malformed response during the authentication handshake. The attack requires network access to the authentication interface and no authentication, but its high complexity (AC:H) means specific conditions must be met, limiting trivial exploitation; no public exploit code has been identified at time of analysis. Impact is confined to availability with no confidentiality or integrity consequences.
Persistent denial-of-service in Absolute Security Secure Access servers prior to version 14.57 is achievable by network attackers who have established a man-in-the-middle position, exploiting an out-of-bounds read triggered by specially crafted data. The impact is described as persistent, meaning the service does not self-recover and requires manual intervention, making this operationally disruptive for organizations that depend on Secure Access for network connectivity. No active exploitation has been confirmed by CISA KEV, and no public exploit code has been identified at time of analysis.
Persistent denial-of-service in Absolute Secure Access servers before version 14.55 allows a remote attacker with deep, low-level command of the tunnel protocol to corrupt server-side memory management and keep the server down. The flaw carries a CVSS 4.0 base score of 8.7 driven entirely by an availability (VA:H) impact, with no confidentiality or integrity consequence. No public exploit identified at time of analysis and it is not listed in CISA KEV, so real-world exploitation appears unproven.
Persistent denial-of-service in Absolute Secure Access servers before version 14.55 allows an authenticated tunnel participant to permanently crash or wedge the server by abusing the tunnel protocol. The CVSS 4.0 vector (7.1, PR:L, VA:H) confirms an availability-only impact requiring some level of tunnel authentication, with no confidentiality or integrity effect despite a mislabeled 'Information Disclosure' tag. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Local privilege escalation in Absolute Secure Access for Windows (client and server) before version 14.55 allows a low-privileged local user to gain Administrator rights when the software is installed to a non-default directory, due to an insecure installer permission configuration. Absolute (formerly NetMotion) assigns this a CVSS 4.0 base score of 8.5 (High), reflecting full local compromise of confidentiality, integrity, and availability. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Persistent denial of service in Absolute Secure Access servers prior to 14.60 allows authenticated attackers to exhaust proxy sub-system resources by sending malformed data, requiring a valid session and an additional environmental precondition outside the attacker's direct control. The flaw is a CWE-400 uncontrolled resource consumption issue with impact limited to availability; confidentiality and integrity are unaffected. No public exploit code has been identified at time of analysis, and the vendor has released a patch in version 14.60.
Resource exhaustion in Absolute Security Secure Access publisher (versions prior to 14.55) enables authenticated remote attackers holding valid tunnel credentials to trigger a non-persistent denial of service against the publisher component. The CVSS 4.0 score of 5.1 (Medium) reflects the constrained impact: availability loss is limited and self-recovering, with no confidentiality or integrity exposure. No public exploit code and no CISA KEV listing identified at time of analysis.
Memory management flaw in Absolute Secure Access prior to version 14.55 allows a remote attacker with deep protocol knowledge and tunnel control to trigger a non-persistent denial-of-service against the server component. Both client and server software are identified as affected per the vendor's own disclosure. No public exploit code and no CISA KEV listing are confirmed at time of analysis, and the non-persistent DoS nature implies the server likely auto-recovers, constraining operational impact.
Non-persistent denial-of-service affecting Absolute Secure Access clients prior to version 14.55 can be triggered by an attacker who possesses intimate knowledge of and total control over the underlying tunnel protocol, yielding low availability impact limited to the client process. The CVSS 4.0 score of 2.3 reflects the highly constrained exploitation requirements captured by AT:P and UI:P - this is not opportunistic exploitation but a targeted, condition-heavy attack against a specific client. No active exploitation has been identified, no public exploit code exists, and the DoS is explicitly described as non-persistent, meaning the client recovers without lasting damage.
Frameable content on the Absolute Secure Access server login page (versions prior to 14.55) enables clickjacking attacks that can result in administrator credential theft. An attacker who controls a malicious website can embed the login page in a hidden iframe, luring an unwitting administrator to unknowingly submit their credentials into the framed interface. No public exploit has been identified at time of analysis, and the CVSS 4.0 vector indicates active user interaction is required, limiting opportunistic exploitation.
Memory disclosure in Absolute Security Secure Access client (versions prior to 14.55) permits a small, indeterminate amount of process memory to leak to an adversary who has already achieved full control over the tunnel protocol. The CVSS 4.0 score of 2.1 accurately reflects the narrow real-world impact: an attacker must simultaneously possess intimate protocol knowledge and the ability to manipulate tunnel communications end-to-end, a prerequisite that dramatically limits the exploitable population. No public exploit code exists and the vulnerability does not appear in the CISA KEV catalog, reinforcing its low operational priority for most enterprises.
Integer underflow in the traffic parsing function of Absolute Security Secure Access clients prior to version 14.55 enables a non-persistent denial-of-service condition against the client application. Exploitation demands the attacker possess intimate knowledge of the proprietary tunnel protocol AND maintain total control over that tunnel - an exceptionally high bar that drastically limits realistic attacker population. The impact is restricted to temporarily disrupting the Secure Access client on the victim endpoint; the service recovers without persistent damage. No public exploit code exists and this vulnerability is not listed in CISA KEV.
Integer underflow in Absolute Security's Secure Access client prior to version 14.55 allows an attacker with full control over the tunnel protocol to cause a non-persistent denial of service against the client. The exploitation bar is extremely high - the attacker must possess both intimate knowledge of the proprietary tunnel protocol and total control over the communication channel. No public exploit code exists and this vulnerability is not listed in CISA KEV; the vendor-reported CVSS 4.0 score of 2.1 reflects the negligible real-world risk.
Heap overflow in Absolute Security Secure Access client certificate parsing causes a local denial of service. Versions prior to 14.55 are affected. An attacker who already holds local administrator privileges on a managed endpoint can trigger the overflow to crash the Secure Access client, effectively disabling it on that machine. No public exploit code has been identified, and this vulnerability is not listed in the CISA KEV catalog.
Unauthenticated remote attackers can cause a persistent denial of service on Absolute Secure Access servers running versions prior to 14.60 by sending specially crafted traffic to the connection setup subsystem. The flaw affects only availability (CVSS 4.0 score 8.7, CVSS 3.1 A:H), with no impact to confidentiality or integrity. A vendor patch is available in version 14.60; no public exploit code or active exploitation has been identified at time of analysis.
Persistent denial of service in Absolute Secure Access servers before 14.60 can be triggered by an authenticated remote attacker who sends malformed data to the client registration process, causing availability impact that outlasts the triggering request. The flaw requires network reachability and valid credentials, as reflected by PR:L in the vendor and independent vectors, so it is not an unauthenticated attack; no public exploit identified at time of analysis. The vendor rates it CVSS 7.1 High, while the independent assessment characterizes it as a genuine but moderate-priority availability issue because of the authentication prerequisite and availability-only impact.
Denial of service in Absolute Secure Access servers before version 14.60 allows unauthenticated remote attackers to cause a persistent outage by sending a malformed response during the authentication handshake. The attack requires network access to the authentication interface and no authentication, but its high complexity (AC:H) means specific conditions must be met, limiting trivial exploitation; no public exploit code has been identified at time of analysis. Impact is confined to availability with no confidentiality or integrity consequences.
Persistent denial-of-service in Absolute Security Secure Access servers prior to version 14.57 is achievable by network attackers who have established a man-in-the-middle position, exploiting an out-of-bounds read triggered by specially crafted data. The impact is described as persistent, meaning the service does not self-recover and requires manual intervention, making this operationally disruptive for organizations that depend on Secure Access for network connectivity. No active exploitation has been confirmed by CISA KEV, and no public exploit code has been identified at time of analysis.
Persistent denial-of-service in Absolute Secure Access servers before version 14.55 allows a remote attacker with deep, low-level command of the tunnel protocol to corrupt server-side memory management and keep the server down. The flaw carries a CVSS 4.0 base score of 8.7 driven entirely by an availability (VA:H) impact, with no confidentiality or integrity consequence. No public exploit identified at time of analysis and it is not listed in CISA KEV, so real-world exploitation appears unproven.
Persistent denial-of-service in Absolute Secure Access servers before version 14.55 allows an authenticated tunnel participant to permanently crash or wedge the server by abusing the tunnel protocol. The CVSS 4.0 vector (7.1, PR:L, VA:H) confirms an availability-only impact requiring some level of tunnel authentication, with no confidentiality or integrity effect despite a mislabeled 'Information Disclosure' tag. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Local privilege escalation in Absolute Secure Access for Windows (client and server) before version 14.55 allows a low-privileged local user to gain Administrator rights when the software is installed to a non-default directory, due to an insecure installer permission configuration. Absolute (formerly NetMotion) assigns this a CVSS 4.0 base score of 8.5 (High), reflecting full local compromise of confidentiality, integrity, and availability. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Persistent denial of service in Absolute Secure Access servers prior to 14.60 allows authenticated attackers to exhaust proxy sub-system resources by sending malformed data, requiring a valid session and an additional environmental precondition outside the attacker's direct control. The flaw is a CWE-400 uncontrolled resource consumption issue with impact limited to availability; confidentiality and integrity are unaffected. No public exploit code has been identified at time of analysis, and the vendor has released a patch in version 14.60.
Resource exhaustion in Absolute Security Secure Access publisher (versions prior to 14.55) enables authenticated remote attackers holding valid tunnel credentials to trigger a non-persistent denial of service against the publisher component. The CVSS 4.0 score of 5.1 (Medium) reflects the constrained impact: availability loss is limited and self-recovering, with no confidentiality or integrity exposure. No public exploit code and no CISA KEV listing identified at time of analysis.
Memory management flaw in Absolute Secure Access prior to version 14.55 allows a remote attacker with deep protocol knowledge and tunnel control to trigger a non-persistent denial-of-service against the server component. Both client and server software are identified as affected per the vendor's own disclosure. No public exploit code and no CISA KEV listing are confirmed at time of analysis, and the non-persistent DoS nature implies the server likely auto-recovers, constraining operational impact.
Non-persistent denial-of-service affecting Absolute Secure Access clients prior to version 14.55 can be triggered by an attacker who possesses intimate knowledge of and total control over the underlying tunnel protocol, yielding low availability impact limited to the client process. The CVSS 4.0 score of 2.3 reflects the highly constrained exploitation requirements captured by AT:P and UI:P - this is not opportunistic exploitation but a targeted, condition-heavy attack against a specific client. No active exploitation has been identified, no public exploit code exists, and the DoS is explicitly described as non-persistent, meaning the client recovers without lasting damage.
Frameable content on the Absolute Secure Access server login page (versions prior to 14.55) enables clickjacking attacks that can result in administrator credential theft. An attacker who controls a malicious website can embed the login page in a hidden iframe, luring an unwitting administrator to unknowingly submit their credentials into the framed interface. No public exploit has been identified at time of analysis, and the CVSS 4.0 vector indicates active user interaction is required, limiting opportunistic exploitation.
Memory disclosure in Absolute Security Secure Access client (versions prior to 14.55) permits a small, indeterminate amount of process memory to leak to an adversary who has already achieved full control over the tunnel protocol. The CVSS 4.0 score of 2.1 accurately reflects the narrow real-world impact: an attacker must simultaneously possess intimate protocol knowledge and the ability to manipulate tunnel communications end-to-end, a prerequisite that dramatically limits the exploitable population. No public exploit code exists and the vulnerability does not appear in the CISA KEV catalog, reinforcing its low operational priority for most enterprises.
Integer underflow in the traffic parsing function of Absolute Security Secure Access clients prior to version 14.55 enables a non-persistent denial-of-service condition against the client application. Exploitation demands the attacker possess intimate knowledge of the proprietary tunnel protocol AND maintain total control over that tunnel - an exceptionally high bar that drastically limits realistic attacker population. The impact is restricted to temporarily disrupting the Secure Access client on the victim endpoint; the service recovers without persistent damage. No public exploit code exists and this vulnerability is not listed in CISA KEV.
Integer underflow in Absolute Security's Secure Access client prior to version 14.55 allows an attacker with full control over the tunnel protocol to cause a non-persistent denial of service against the client. The exploitation bar is extremely high - the attacker must possess both intimate knowledge of the proprietary tunnel protocol and total control over the communication channel. No public exploit code exists and this vulnerability is not listed in CISA KEV; the vendor-reported CVSS 4.0 score of 2.1 reflects the negligible real-world risk.
Heap overflow in Absolute Security Secure Access client certificate parsing causes a local denial of service. Versions prior to 14.55 are affected. An attacker who already holds local administrator privileges on a managed endpoint can trigger the overflow to crash the Secure Access client, effectively disabling it on that machine. No public exploit code has been identified, and this vulnerability is not listed in the CISA KEV catalog.