Secomea vulnerabilities

Products

• GateManager 37
• gatemanager 8250 firmware 20
• gatemanager 4250 firmware 14
• gatemanager 4260 firmware 14
• gatemanager 9250 firmware 14
• SiteManager 10
• sitemanager 1129 firmware 7
• sitemanager 1139 firmware 7
• sitemanager 1149 firmware 7
• sitemanager 3329 firmware 7
• sitemanager 3339 firmware 7
• sitemanager 3349 firmware 7
• sitemanager 3529 firmware 7
• sitemanager 3539 firmware 7
• sitemanager 3549 firmware 7
• gatemanager firmware 3
• sitemanager firmware 3
• sitemanager 1529 firmware 2
• sitemanager 1539 firmware 2
• sitemanager 1549 firmware 2
• SiteManager Embedded 2
• linkmanager 1
• SiteManager Embedded (SM-E) 1

Latest Secomea CVEs

Newest publication first · page 1 of 2

1. CVE-2026-1759 Improper handling of insufficient permissions or privileges vulnerability in Secomea GateManager allows Privilege Escalation. This issue affects GateManager: 11.5;0, 11.4.625515072:0. Fixed in Version...

   Published 2026-09-15

   Medium·CVSS 6.5 EPSS 0.34%

   Improper handling of insufficient permissions or privileges vulnerability in Secomea GateManager allows Privilege Escalation. This issue affects GateManager: 11.5;0, 11.4.625515072:0. Fixed in Version 11.6 or 11.4.626194074 and above

2. CVE-2026-1758 Session Fixation

   Published 2026-09-15

   High·CVSS 8.3 EPSS 0.39%

   Session fixation vulnerability in Secomea GateManager (webserver module) allows Session Fixation. This issue affects GateManager: 11.5;0, 11.4.625515072:0. Fixed in Version 11.6 or 11.4.626194074 and above

3. CVE-2025-14716 Unauthorized access to information

   Published 2026-03-19

   Medium·CVSS 6.5 EPSS 0.37%

   Improper Authentication vulnerability in Secomea GateManager (webserver modules) allows Authentication Bypass.This issue affects GateManager: 11.4;0.

4. CVE-2021-32007 Missing security header: Referrer-Policy URL

   Published 2024-12-13

   Low·CVSS 3.5 EPSS 0.26%

   This issue affects: Secomea GateManager Version 9.5 and all prior versions. Protection Mechanism Failure vulnerability in web server of Secomea GateManager to potentially leak information to remote servers.

5. CVE-2024-1969 Heap buffer overflow

   Published 2024-04-29

   High·CVSS 8.2 EPSS 0.46%

   Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in Secomea GateManager (webserver modules) allows crash of GateManager.This issue affects GateManager: from 9.7 before 11.2.624095033.

6. CVE-2024-1579 Insufficient seeding of random number generator

   Published 2024-04-29

   High·CVSS 8.1 EPSS 0.52%

   Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG) vulnerability in Secomea GateManager (Webserver modules) allows Session Hijacking.This issue affects GateManager: before 11.2.624071020.

7. CVE-2023-3675 Insufficient input validation when downloading certain file types.

   Published 2024-04-18

   Medium·CVSS 6.5 EPSS 0.54%

   Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Secomea GateManager (Web GUI) allows Reading Data from System Resources.This issue affects GateManager: from 11.0.623074018 before 11.0.623373051.

8. CVE-2023-2912 SiteManager Embedded service disruption

   Published 2023-07-17

   High·CVSS 7.5 EPSS 0.54%

   Use After Free vulnerability in Secomea SiteManager Embedded allows Obstruction.

9. CVE-2022-38125 FTP Agent forwards traffic on inactive ports to LinkManager

   Published 2023-04-19

   Medium·CVSS 5.5 EPSS 0.16%

   Improper Restriction of Communication Channel to Intended Endpoints vulnerability in Secomea SiteManager (FTP Agent modules) allows Exploiting Trust in Client.

10. CVE-2023-0317 GateManager debug interface is included in non-debug builds

    Published 2023-04-19

    Medium·CVSS 4.9 EPSS 0.52%

    Unprotected Alternate Channel vulnerability in debug console of GateManager allows system administrator to obtain sensitive information.

11. CVE-2022-4308 Clear-text passwords in configuration files

    Published 2023-04-19

    High·CVSS 8.8 EPSS 0.17%

    Plaintext Storage of a Password vulnerability in Secomea GateManager (USB wizard) allows Authentication abuse on SiteManager, if the generated file is leaked.

12. CVE-2022-38124 Unwanted debug tool

    Published 2022-12-13

    Medium·CVSS 6.5 EPSS 0.55%

    Debug tool in Secomea SiteManager allows logged-in administrator to modify system state in an unintended manner.

13. CVE-2022-2752 Potential vulnerabilities in GM login process

    Published 2022-12-09

    High·CVSS 7.8 EPSS 0.18%

    A vulnerability in the web server of Secomea GateManager allows a local user to impersonate as the previous user under some failed login conditions. This issue affects: Secomea GateManager versions from 9.4 through 9.7.

14. CVE-2022-38123 Insufficient validation of plugin files

    Published 2022-12-06

    High·CVSS 7.2 EPSS 0.81%

    Improper Input Validation of plugin files in Administrator Interface of Secomea GateManager allows a server administrator to inject code into the GateManager interface. This issue affects: Secomea GateManager versions prior to 10.0.

15. CVE-2022-25786 GateManager debug interface is included in production builds

    Published 2022-05-04

    Medium·CVSS 4.9 EPSS 0.74%

    Unprotected Alternate Channel vulnerability in debug console of GateManager allows system administrator to obtain sensitive information. This issue affects: GateManager all versions prior to 9.7.

16. CVE-2022-25787 GTA URLs issued by LMM WEB API may leak information

    Published 2022-05-04

    Medium·CVSS 6.7 EPSS 0.24%

    Information Exposure Through Query Strings in GET Request vulnerability in LMM API of Secomea GateManager allows system administrator to hijack connection. This issue affects: Secomea GateManager all versions prior to 9.7.

17. CVE-2022-25785 Buffer overrun

    Published 2022-05-04

    High·CVSS 7.2 EPSS 1.0%

    Stack-based Buffer Overflow vulnerability in SiteManager allows logged-in or local user to cause arbitrary code execution. This issue affects: Secomea SiteManager all versions prior to 9.7.

18. CVE-2022-25784 User controllable HTML element attribute (potential XSS)

    Published 2022-05-04

    Medium·CVSS 4.8 EPSS 0.61%

    Cross-site Scripting (XSS) vulnerability in Web GUI of SiteManager allows logged-in user to inject scripting. This issue affects: Secomea SiteManager all versions prior to 9.7.

19. CVE-2022-25783 Hacking attempts from logged-in users are not properly logged by GM

    Published 2022-05-04

    Medium·CVSS 4.3 EPSS 0.63%

    Insufficient Logging vulnerability in web server of Secomea GateManager allows logged in user to issue improper queries without logging. This issue affects: Secomea GateManager versions prior to 9.7.

20. CVE-2022-25782 Insufficient privilege checks on object access and updates.

    Published 2022-05-04

    Medium·CVSS 5.4 EPSS 0.50%

    Improper Handling of Insufficient Privileges vulnerability in Web UI of Secomea GateManager allows logged in user to access and update privileged information. This issue affects: Secomea GateManager versions prior to 9.7.

21. CVE-2022-25781 Reflected XSS issues in GateManager

    Published 2022-05-04

    Medium·CVSS 6.1 EPSS 0.50%

    Cross-site Scripting (XSS) vulnerability in Web UI of Secomea GateManager allows phishing attacker to inject javascript or html into logged in user session.

22. CVE-2022-25780 Information leak via device availability query function

    Published 2022-05-04

    Medium·CVSS 4.3 EPSS 0.63%

    Information Exposure vulnerability in web UI of Secomea GateManager allows logged in user to query devices outside own scope.

23. CVE-2022-25779 Insufficient scope checks allows adding unrelated audit log entries

    Published 2022-05-04

    Medium·CVSS 4.3 EPSS 0.55%

    Logging of Excessive Data vulnerability in audit log of Secomea GateManager allows logged in user to write text entries in audit log. This issue affects: Secomea GateManager versions prior to 9.7.

24. CVE-2022-25778 Unload handlers may unintentionally defeat CSRF guards

    Published 2022-05-04

    High·CVSS 8.8 EPSS 0.28%

    Cross-Site Request Forgery (CSRF) vulnerability in Web UI of Secomea GateManager allows phishing attacker to issue get request in logged in user session.

25. CVE-2021-32010 Clients may connect to a GateManager with TLS 1.0

    Published 2022-05-04

    High·CVSS 8.1 EPSS 0.23%

    Inadequate Encryption Strength vulnerability in TLS stack of Secomea SiteManager, LinkManager, GateManager may facilitate man in the middle attacks. This issue affects: Secomea SiteManager All versions prior to 9.7. Secomea LinkManager versions prior to 9.7. Secomea GateManager v...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.