CVE-2021-32004: GateManager does not enforce strict hostname matching for WEB server

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-11-22 · updated 2026-06-17
Weakness: CWE-923

Description

This issue affects: Secomea GateManager All versions prior to 9.6. Improper Check of host header in web server of Secomea GateManager allows attacker to cause browser cache poisoning.

Affected products

Secomea GateManager all versions prior to 9.2c: before 9.6 — fixed in 9.6

How to fix

Upgrade to a fixed version: Secomea GateManager all versions prior to 9.2c 9.6. Check the vendor advisory for mitigations.

References

https://www.secomea.com/support/cybersecurity-advisory/#4578
https://www.secomea.com/support/cybersecurity-advisory/#4578

Get alerted when CVE-2021-32004 or the next vulnerability affects your stack