Pulseway Security Statement: Apache Log4j Vulnerability

• Monday 13 December 2021

On Friday December 10, 2021 we have seen the announcement of unknown zero day vulnerability (CVE-2021-44228) for the commonly used logging library for Java-based software called log4j.

Pulseway software and integrations do not use the log4j library and therefore have not been impacted by this vulnerability.

As a security measure, our team has conducted a full impact assessment since the vulnerability was initially documented, and we have found no component or service offered by Pulseway to be affected.

Components analyzed and identified as secure:

• Pulseway backend services (Core WebService, RESTful APIs, API Gateways)
• Remote Control (WebService and Application)
• Agents (Windows, Linux and macOS)
• Mobile Apps (iOS and Android)
• Integrations (ConnectWise, Slack, Autotask, PagerDuty)
• PSA (Integration and Application)
• Backup Services (Integration, Agent and Backend Services)

At this moment there are no components that were identified as vulnerable to the exploit.

We are constantly monitoring the response of security researchers to observe the further discovery of this vulnerability and other that may arrive. Further updates will be posted on this page as necessary.

By 6 AM ET, December, 13^th, 2021