BullWall Server Intrusion Protection RDP Connection Delay Vulnerability Allowing Detection Bypass

A vulnerability exists in BullWall Server Intrusion Protection due to a significant delay before the multi-factor authentication (MFA) check when connecting via Remote Desktop Protocol (RDP). This delay creates a window of opportunity for remote authenticated attackers with administrative privileges to potentially bypass detection. The issue has been confirmed in versions 4.6.0.0, 4.6.0.6, 4.6.0.7, and 4.6.1.4, with the possibility that other versions before and after may also be affected.

Impact

Exploitation of this vulnerability could lead to a bypass of intrusion detection mechanisms, allowing malicious activities to go undetected during the MFA delay window.