Security readout for executives and security teams
Plain-English summary
This issue lets a read-only ProxySG administrator go beyond viewing and run arbitrary CLI commands after establishing an HTTPS session. That can turn a low-privilege admin account into meaningful control over a security gateway. The sources do not provide CVSS scoring or exploitation evidence.
Executive priority
Prioritize remediation for internet- or broadly reachable management interfaces and environments with many delegated administrators. The issue is older, but affected appliances can still carry high operational risk because ProxySG often sits in sensitive traffic-control paths.
Technical view
CVE-2010-5189 affects Blue Coat ProxySG running SGOS before 4.3.4.1, 5.x before 5.4.5.1, 5.5 before 5.5.4.1, and 6.x before 6.1.1.1. Remote authenticated users with read-only administrator privileges can execute arbitrary CLI commands via an HTTPS session.
Likely exposure
Exposure is likely limited to organizations with affected ProxySG SGOS versions and read-only administrator accounts. Risk is higher if the HTTPS management interface is reachable by broad internal networks, contractors, or compromised admin workstations.
Exploitation context
The provided sources do not show known active exploitation, and the CVE is not marked KEV. Exploitation requires authentication as a read-only administrator and an HTTPS session, but successful abuse could undermine administrative role separation on the appliance.
Researcher notes
Evidence is sparse: the source bundle includes the CVE description and a vendor advisory URL, but no CVSS, CWE, exploit references, or detailed root cause. Treat the affected version ranges and privilege requirement as the most reliable facts.
Mitigation direction
- Upgrade ProxySG SGOS to a fixed version listed by the CVE or vendor advisory.
- Review Blue Coat SA45 for vendor-specific remediation guidance.
- Restrict HTTPS management access to trusted administrative networks only.
- Remove unnecessary read-only administrator accounts.
- Monitor administrative logs for unexpected CLI activity.
Validation and detection
- Inventory ProxySG appliances and record SGOS versions.
- Compare each version against the affected ranges in the CVE.
- List read-only administrator accounts and confirm business need.
- Verify HTTPS management access is network-restricted.
- Review recent administrative logs for unusual command activity.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2010-5189 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://kb.bluecoat.com/index?page=content&id=SA45CVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.