Critical severity · published Jun 16, 2011
CVE-2011-1889
Microsoft Forefront TMG Remote Code Execution Vulnerability
In wildKEV
9.8
CVSS
49%
EPSS
Yes
On KEV
Description
The NSPLookupServiceNext function in the client in Microsoft Forefront Threat Management Gateway (TMG) 2010 allows remote attackers to execute arbitrary code via vectors involving unspecified requests, aka "TMG Firewall Client Memory Corruption Vulnerability."
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)49.0% · higher than 99% of CVEs
Exploited in the wildYes
CISA KEVListed Mar 3, 2022
Federal remediation dueMar 24, 2022
Ransomware campaign useNot known
Affected products
Which versions
FT
Forefront Threat Management Gateway · Microsoft
2010 · source: NVD
FT
Forefront Threat Management Gateway (TMG) · Microsoft
All versions, or not specified · source: KEV
Affected product
FT
Forefront Threat Management Gateway
Microsoft
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2011-1889
CVE.org
https://www.cve.org/CVERecord?id=CVE-2011-1889
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
vdb-entry
http://www.securitytracker.com/id?1025637
vendor-advisory
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-040
vdb-entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/67736
vdb-entry
http://www.securityfocus.com/bid/48181
third-party-advisory
http://secunia.com/advisories/44857
vdb-entry
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12642
More from Forefront Threat Management Gateway
–
CVE-2009-0237
Cross-site scripting (XSS) vulnerability in cookieauth.dll in the HTML forms authentication component in Microsoft Forefront Threat Management Gateway, Medium Business Edition…
–
CVE-2009-0077
The firewall engine in Microsoft Forefront Threat Management Gateway, Medium Business Edition (TMG MBE); and Internet Security and Acceleration (ISA) Server 2004 SP3, 2006, 2006…