Lucene search

MitreCVE-2021-33903

HistoryOct 07, 2021 - 3:15 p.m.

CVE-2021-33903

2021-10-0715:15:10

mitre

web.nvd.nist.gov

cve-2021-33903

lcos

lancom

snmpv3

password vulnerability

nvd

CVSS2

8.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:S/C:C/I:C/A:C

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.8

Confidence

High

EPSS

0.001

Percentile

42.8%

JSON

In LCOS 10.40 to 10.42.0473-RU3 with SNMPv3 enabled on LANCOM devices, changing the password of the root user via the CLI does not change the password of the root user for SNMPv3 access. (However, changing the password of the root user via LANconfig does change the password of the root user for SNMPv3 access.)

Affected configurations

Nvd

Node

lancom-systemslcosRange10.40–10.42.0473

lancom-systemslcosMatch10.42.0473-

lancom-systemslcosMatch10.42.0473release_update1

lancom-systemslcosMatch10.42.0473release_update2

lancom-systemslcosMatch10.42.0473release_update3

VendorProductVersionCPE
lancom-systemslcos*cpe:2.3:o:lancom-systems:lcos:*:*:*:*:*:*:*:*
lancom-systemslcos10.42.0473cpe:2.3:o:lancom-systems:lcos:10.42.0473:-:*:*:*:*:*:*
lancom-systemslcos10.42.0473cpe:2.3:o:lancom-systems:lcos:10.42.0473:release_update1:*:*:*:*:*:*
lancom-systemslcos10.42.0473cpe:2.3:o:lancom-systems:lcos:10.42.0473:release_update2:*:*:*:*:*:*
lancom-systemslcos10.42.0473cpe:2.3:o:lancom-systems:lcos:10.42.0473:release_update3:*:*:*:*:*:*

Vendor	Product	Version	CPE
lancom-systems	lcos	*	cpe:2.3:o:lancom-systems:lcos::::::::
lancom-systems	lcos	10.42.0473	cpe:2.3:o:lancom-systems:lcos:10.42.0473:-::::::
lancom-systems	lcos	10.42.0473	cpe:2.3:o:lancom-systems:lcos:10.42.0473:release_update1::::::
lancom-systems	lcos	10.42.0473	cpe:2.3:o:lancom-systems:lcos:10.42.0473:release_update2::::::
lancom-systems	lcos	10.42.0473	cpe:2.3:o:lancom-systems:lcos:10.42.0473:release_update3::::::

References

www.nmedv.de/wp-content/uploads/2021/10/NME-2021-001.txt

CVSS2

8.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:S/C:C/I:C/A:C

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.8

Confidence

High

EPSS

0.001

Percentile

42.8%

JSON

Related for CVE-2021-33903