CVE-2015-1454

Severity: high (CVSS 7.1 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2015-02-02 · updated 2026-06-17
Weakness: CWE-310

Description

Blue Coat ProxyClient before 3.3.3.3 and 3.4.x before 3.4.4.10 and Unified Agent before 4.1.3.151952 does not properly validate certain certificates, which allows man-in-the-middle attackers to spoof ProxySG Client Managers, and consequently modify configurations and execute arbitrary software updates, via a crafted certificate.

Affected products

Bluecoat Proxyclient: from 3.3 before 3.3.3.3; from 3.4 before 3.4.4.10 — fixed in 3.3.3.3, 3.4.4.10
Bluecoat Unified Agent: through 4.1.3

How to fix

Upgrade to a fixed version: Bluecoat Proxyclient 3.3.3.3, 3.4.4.10. Check the vendor advisory for mitigations.

References

http://secunia.com/advisories/62617
https://bto.bluecoat.com/security-advisory/sa89
http://secunia.com/advisories/62617
https://bto.bluecoat.com/security-advisory/sa89

Get alerted when CVE-2015-1454 or the next vulnerability affects your stack