CVE-2021-22894

A flaw in Pulse Connect Secure allows an authenticated user to send a specially crafted meeting room request that overflows a memory buffer, letting them run malicious code with administrative privileges on the server.

Buffer overflow vulnerability in Pulse Connect Secure versions prior to 9.1R11.4 exploitable by authenticated attackers via maliciously crafted meeting room input, resulting in arbitrary code execution with root privileges. The vulnerability stems from insufficient input validation on meeting room parameters, allowing memory corruption and control flow hijacking.