CVE-2002-1979

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

WatchGuard SOHO products running firmware 5.1.6 and earlier, and Vclass/RSSA using 3.2 SP1 and earlier, allows remote attackers to bypass firewall rules by sending a PASV command string as the argument of another command to an FTP server, which generates a response that contains the string, causing IPFilter to treat the response as if it were a legitimate PASV command from the server.

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Weakness enumeration

CWE-20

Affected software

VendorProductVersions
n/an/an/a

References

Timeline

Published
Dec 31, 2002
Last modified
Jun 16, 2026
NVD status
Modified

Related CVEs from 2002

CVE-2002-19807.2Buffer overflow in Volume Manager daemon (vold) of Sun Solaris 2.5.1 through 8 allows local users to execute arbitrary code via unknown attaCVE-2002-19815.0Microsoft SQL Server 2000 through SQL Server 2000 SP2 allows the "public" role to execute the (1) sp_MSSetServerProperties or (2) sp_MSsetalCVE-2002-19825.0Directory traversal vulnerability in the list_directory function in Icecast 1.3.12 allows remote attackers to determine if a directory existCVE-2002-19832.1The timer implementation in QNX RTOS 6.1.0 allows local users to cause a denial of service (hang) and possibly execute arbitrary code by creCVE-2002-19845.0Microsoft Internet Explorer 5.0.1 through 6.0 on Windows 2000 or Windows XP allows remote attackers to cause a denial of service (crash) viaCVE-2002-19855.0iSMTP 5.0.1 allows remote attackers to cause a denial of service via a long "MAIL FROM" command, possibly triggering a buffer overflow.CVE-2002-19865.0Perception LiteServe 2.0 through 2.0.1 allows remote attackers to obtain the source code of CGI scripts via an HTTP request with a trailing CVE-2002-19875.0Directory traversal vulnerability in view_source.jsp in Resin 2.1.2 allows remote attackers to read arbitrary files via a "\.." (backslash dCVE-2002-19885.0Resin 2.1.1 allows remote attackers to cause a denial of service (memory consumption and hang) via a URL with long variables for non-existenCVE-2002-19895.0Resin 2.1.1 allows remote attackers to cause a denial of service (thread and connection consumption) via multiple URL requests containing thCVE-2002-19905.0Resin 2.0.5 through 2.1.2 allows remote attackers to reveal physical path information via a URL request for the example Java class file HellCVE-2002-19917.5PHP file inclusion vulnerability in osCommerce 2.1 execute arbitrary commands via the include_file parameter to include_once.php.
CVE-2002-1979: High severity, CVSS 7.5 | Vulnix