An unauthenticated file read on Pulse Connect Secure exposed cleartext credentials. Organizations that patched but did not reset passwords stayed compromised.
Publicly disclosed: 24 April 2019
On 24 April 2019 Pulse Secure released fixes for a critical vulnerability in Pulse Connect Secure VPN. Without logging in, an attacker could read arbitrary files from the appliance — including files with cached usernames and passwords in clear text. Exploitation became widespread in late 2019, and in 2020 CISA warned that attackers were still logging in with credentials stolen before organizations had patched.
| CVE | Severity | Affected | Fixed in |
|---|---|---|---|
CVE-2019-11510 | Critical, CVSS 10.0 (arbitrary file read) | Pulse Connect Secure 8.2R1–8.2R12, 8.3R1–8.3R7, 9.0R1–9.0R3 | 9.0R3.4, 8.3R7.1, 8.2R12.1, 8.1R15.1 and later |
When a flaw exposes passwords, patching is only half of the work. Every credential that could have been stolen must be changed, and logs must be checked for logins from unusual places — otherwise the attacker simply logs in through the patched VPN.
A patch closes the hole. MFA and a password reset close the door behind it.
Sources: NVD CVE-2019-11510, CISA alert AA20-107A.
Need help with this? Contact CySec for a free consultation.
A newly disclosed exploit chain gives attackers root on on-premises N-central servers; attacks began hours after the proof of concept. No complete fix yet — immediate checks.
Read articleAn exploited Outlook flaw leaks NTLM password hashes from a crafted file. Microsoft fixed over 1,000 vulnerabilities this month — here is what to prioritise.
Read articleGoogle fixed a use-after-free in Chrome that is already exploited. The fix only works after the browser restarts — here is how to make sure every PC is protected.
Read articleOur engineers can review your current setup and propose concrete improvements.
