{"id":10299,"date":"2020-04-20T01:52:58","date_gmt":"2020-04-20T01:52:58","guid":{"rendered":"https:\/\/nsfocusglobal.com\/?p=10299"},"modified":"2026-04-17T18:07:49","modified_gmt":"2026-04-17T18:07:49","slug":"overseas-apt-organization-exploits-vulnerabilities-to-breach-sangfor-ssl-vpns-and-deliver-malicious-code-threat-alert","status":"publish","type":"post","link":"https:\/\/nsfocusglobal.com\/pt-br\/overseas-apt-organization-exploits-vulnerabilities-to-breach-sangfor-ssl-vpns-and-deliver-malicious-code-threat-alert\/","title":{"rendered":"Overseas APT Organization Exploits Vulnerabilities to Breach Sangfor SSL VPNs and Deliver Malicious Code Threat Alert"},"content":{"rendered":"


\n<\/p>\n

Overview<\/strong><\/h2>\n

On April 6, Sangfor released an advisory, announcing that an overseas APT organization illegally took control of some of their SSL VPN devices and sent malicious files to clients by exploiting a client upgrade vulnerability. NSFOCUS has kept a close eye on this issue and conducted overall analysis. We advise related users to take precautions as soon as possible.<\/p>\n

The vulnerability exists due to the defect of the upgrade module signature authentication mechanism of the Windows client of SSL VPN devices. The prerequisite for exploitation is that attackers must take control of SSL VPN privileges. According to Sangfor’s analysis, this vulnerability is difficult to exploit. Therefore, Sangfor estimates that there are only a limited number of affected VPN devices. According to the NSFOCUS security team, not many VPN devices have been compromised by the APT organization, but the affected versions are widely used in enterprises in China.<\/p>\n

<\/p>\n

Reference link:<\/strong><\/p>\n

https:\/\/mp.weixin.qq.com\/s\/lKp_3kPNEycXqfCnVPxoDw<\/p>\n

Scope of Impact<\/strong><\/h2>\n

As confirmed by Sangfor, the following versions of SSL VPN are affected:<\/p>\n