Vulnerability record · CVE-2012-0297 · published 21 May 2012
CVE-2012-0297: Symantec Web Gateway management GUI access control flaw enables remote code execution
Symantec · Web Gateway
The management GUI in Symantec Web Gateway 5.0.x before 5.0.3 fails to properly restrict access to application scripts. Remote attackers can inject or include crafted data to execute arbitrary code. The flaw is remotely reachable without authentication and carries a maximum CVSS v2 base score of 10.
Description
The management GUI in Symantec Web Gateway 5.0.x before 5.0.3 does not properly restrict access to application scripts, which allows remote attackers to execute arbitrary code by (1) injecting crafted data or (2) including crafted data.
AV:N/AC:L/Au:N/C:C/I:C/A:C
Automated analysis
critical priorityUnauthenticated remote code execution with a CVSS v2 score of 10 and very high EPSS probability makes this an urgent patching priority.
What it is
The management GUI in Symantec Web Gateway 5.0.x before 5.0.3 fails to properly restrict access to application scripts. Remote attackers can inject or include crafted data to execute arbitrary code. The flaw is remotely reachable without authentication and carries a maximum CVSS v2 base score of 10.
Impact
An unauthenticated remote attacker can execute arbitrary code on the affected appliance, gaining full control of confidentiality, integrity and availability. This could allow compromise of the gateway and any traffic or credentials it handles.
Attack surface
The vulnerability is in the management GUI and is reachable over the network (AV:N) with no authentication required (Au:N) and low attack complexity (AC:L). No user interaction is indicated by the vector or description.
Exploitation
The record is not listed in CISA KEV and no reference is tagged as exploit code, but EPSS is very high at 0.72596 (99.4th percentile), indicating elevated likelihood of exploitation activity.
What to do
- Upgrade Symantec Web Gateway to 5.0.3 or later as directed by the vendor advisory.
- Restrict network access to the management GUI to trusted administrative networks or VPN only.
- Place the management interface behind a firewall or access control list and disable exposure to the internet.
- Monitor vendor advisories for any further updates if 5.0.3 is not the final fixed release.
- Review logs for unexpected requests to management application scripts.
Detection
- Inspect web server and application logs for crafted requests to management GUI scripts, especially unusual parameters or path traversal patterns.
- Alert on access to the management interface from untrusted or external source IP addresses.
- Monitor for unexpected process execution or outbound connections originating from the Web Gateway appliance.
- Correlate IDS/IPS alerts for known Symantec Web Gateway exploit attempts against management endpoints.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2012-0297 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2012-0297), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
