Read the docs
TI-2009-00762 Aliases CVE-2009-0802GHSA-vh8q-wmg6-w8v4

Qbik WinGate, when transparent interception mode is enabled, uses the HTTP Host header to…

Priority LOW 29CWE-264Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
High
Impact type
Security bypass
Confidentiality · integrity · availability
Complete · None · None
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-264.

Summary

Qbik WinGate, when transparent interception mode is enabled, uses the HTTP Host header to determine the remote endpoint, which allows remote attackers to bypass access controls for Flash, Java, Silverlight, and probably other technologies, and possibly communicate with restricted intranet sites, via a crafted web page that causes a client to send HTTP requests with a modified Host header.

Why it matters now

EPSS 0.02424 84th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 15

CPEVersionsRoleVendor
cpe:2.3:a:qbik:wingate:6.0.0:*:*:*:*:*:*:*6.0.0VulnerableQbik
cpe:2.3:a:qbik:wingate:6.0.1_build_993:*:*:*:*:*:*:*6.0.1_build_993VulnerableQbik
cpe:2.3:a:qbik:wingate:6.0.1_build_995:*:*:*:*:*:*:*6.0.1_build_995VulnerableQbik
cpe:2.3:a:qbik:wingate:6.0.2_build_1000:*:*:*:*:*:*:*6.0.2_build_1000VulnerableQbik
cpe:2.3:a:qbik:wingate:6.0.2_build_1001:*:*:*:*:*:*:*6.0.2_build_1001VulnerableQbik
cpe:2.3:a:qbik:wingate:6.0.3_build_1005:*:*:*:*:*:*:*6.0.3_build_1005VulnerableQbik
cpe:2.3:a:qbik:wingate:6.1:*:*:*:*:*:*:*6.1VulnerableQbik
cpe:2.3:a:qbik:wingate:6.1.1.1077:*:*:*:*:*:*:*6.1.1.1077VulnerableQbik
cpe:2.3:a:qbik:wingate:6.1.2:*:*:*:*:*:*:*6.1.2VulnerableQbik
cpe:2.3:a:qbik:wingate:6.1.3:*:*:*:*:*:*:*6.1.3VulnerableQbik
  • cpe:2.3:a:qbik:wingate:6.0.0:*:*:*:*:*:*:* Versions 6.0.0 Vulnerable ·Qbik
  • cpe:2.3:a:qbik:wingate:6.0.1_build_993:*:*:*:*:*:*:* Versions 6.0.1_build_993 Vulnerable ·Qbik
  • cpe:2.3:a:qbik:wingate:6.0.1_build_995:*:*:*:*:*:*:* Versions 6.0.1_build_995 Vulnerable ·Qbik
  • cpe:2.3:a:qbik:wingate:6.0.2_build_1000:*:*:*:*:*:*:* Versions 6.0.2_build_1000 Vulnerable ·Qbik
  • cpe:2.3:a:qbik:wingate:6.0.2_build_1001:*:*:*:*:*:*:* Versions 6.0.2_build_1001 Vulnerable ·Qbik
  • cpe:2.3:a:qbik:wingate:6.0.3_build_1005:*:*:*:*:*:*:* Versions 6.0.3_build_1005 Vulnerable ·Qbik
  • cpe:2.3:a:qbik:wingate:6.1:*:*:*:*:*:*:* Versions 6.1 Vulnerable ·Qbik
  • cpe:2.3:a:qbik:wingate:6.1.1.1077:*:*:*:*:*:*:* Versions 6.1.1.1077 Vulnerable ·Qbik
  • cpe:2.3:a:qbik:wingate:6.1.2:*:*:*:*:*:*:* Versions 6.1.2 Vulnerable ·Qbik
  • cpe:2.3:a:qbik:wingate:6.1.3:*:*:*:*:*:*:* Versions 6.1.3 Vulnerable ·Qbik
Show 5 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:qbik:wingate:6.1.4:*:*:*:*:*:*:*6.1.4VulnerableQbik
cpe:2.3:a:qbik:wingate:6.2:*:*:*:*:*:*:*6.2VulnerableQbik
cpe:2.3:a:qbik:wingate:6.2.1:*:*:*:*:*:*:*6.2.1VulnerableQbik
cpe:2.3:a:qbik:wingate:6.2.2:*:*:*:*:*:*:*6.2.2VulnerableQbik
cpe:2.3:a:qbik:wingate:6.5.2:*:*:*:*:*:*:*6.5.2VulnerableQbik
  • cpe:2.3:a:qbik:wingate:6.1.4:*:*:*:*:*:*:* Versions 6.1.4 Vulnerable ·Qbik
  • cpe:2.3:a:qbik:wingate:6.2:*:*:*:*:*:*:* Versions 6.2 Vulnerable ·Qbik
  • cpe:2.3:a:qbik:wingate:6.2.1:*:*:*:*:*:*:* Versions 6.2.1 Vulnerable ·Qbik
  • cpe:2.3:a:qbik:wingate:6.2.2:*:*:*:*:*:*:* Versions 6.2.2 Vulnerable ·Qbik
  • cpe:2.3:a:qbik:wingate:6.5.2:*:*:*:*:*:*:* Versions 6.5.2 Vulnerable ·Qbik

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2009-0802
  2. 2026-10-03 Alias added: GHSA-vh8q-wmg6-w8v4

References

Advisory 1

  • TI-2006-02833 Stack-based buffer overflow in the WWW Proxy Server of Qbik WinGate 6.1.1.1077 allows… CVSS 2.0HIGH 7.5
  • TI-1999-00287 The WinGate proxy is installed without a password, which allows remote attackers to… CVSS 2.0HIGH 7.5
  • TI-2020-10850 WinGate v9.4.1.5998 has insecure permissions for the installation directory, which allows… CVSS 3.1HIGH 7.8
  • TI-2008-03453 Heap-based buffer overflow in the IMAP service in Qbik WinGate 6.2.2.1137 and earlier… CVSS 2.0MEDIUM 6.5
  • TI-1999-00436 Remote attackers can perform a denial of service in WinGate machines using a buffer… CVSS 2.0MEDIUM 5.0
  • TI-2006-02824 Directory traversal vulnerability in the IMAP server in WinGate 6.1.2.1094 and… CVSS 2.0MEDIUM 5.5
See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences