Skip to content

Product

kerio serverfirewall vulnerabilities

3 published CVES affecting kerio serverfirewall, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
3
Critical
0
High
0
Medium
0
Low
3
Unscored
0
CISA KEV
0

Latest kerio serverfirewall CVEs

Newest publication first

  1. CVE-2005-3286 The FWDRV driver in Kerio Personal Firewall 4.2 and Server Firewall 1.1.1 allows local users to cause a denial of service (crash) by setting the PAGE_NOACCESS or PAGE_GUARD protection on the Page Envi...

    Published
    LowCVSS 2.1 EPSS 0.38%

    The FWDRV driver in Kerio Personal Firewall 4.2 and Server Firewall 1.1.1 allows local users to cause a denial of service (crash) by setting the PAGE_NOACCESS or PAGE_GUARD protection on the Page Environment Block (PEB), which triggers an exception, aka the "PEB lockout vulnerabi...

  2. CVE-2004-1023 Kerio Winroute Firewall before 6.0.9, ServerFirewall before 1.0.1, and MailServer before 6.0.5, when installed on Windows based systems, do not modify the ACLs for critical files, which allows local u...

    Published
    LowCVSS 2.1 EPSS 0.29%

    Kerio Winroute Firewall before 6.0.9, ServerFirewall before 1.0.1, and MailServer before 6.0.5, when installed on Windows based systems, do not modify the ACLs for critical files, which allows local users with Power Users privileges to modify programs, install malicious DLLs in t...

  3. CVE-2004-1022 Kerio Winroute Firewall before 6.0.7, ServerFirewall before 1.0.1, and MailServer before 6.0.5 use symmetric encryption for user passwords, which allows attackers to decrypt the user database and obta...

    Published
    LowCVSS 2.1 EPSS 0.21%

    Kerio Winroute Firewall before 6.0.7, ServerFirewall before 1.0.1, and MailServer before 6.0.5 use symmetric encryption for user passwords, which allows attackers to decrypt the user database and obtain the passwords by extracting the secret key from within the software.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.