Description
Improper certificate validation in the tunnel handshake in Cato Client allows a man-in-the-middle attacker to impersonate a Cato Point of Presence (PoP) server and intercept or modify tunnel traffic.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Cato Networks | Cato Client for Windows | < 6.12.6 | 6.12.6 |
| Cato Networks | Cato Client for macOS | < 6.1.1 | 6.1.1 |
| Cato Networks | Cato Client for Linux | < 5.8.1 | 5.8.1 |
| Cato Networks | Cato Client for iOS | < 5.9 | 5.9 |
| Cato Networks | Cato Client for Android | < 5.6.2 | 5.6.2 |
References
- Cato Networks Security Advisory vendor-advisory