Lucene search

MitreCVE-2021-37471

HistoryNov 07, 2021 - 4:15 p.m.

CVE-2021-37471

2021-11-0716:15:07

mitre

web.nvd.nist.gov

cradlepoint

ibr900-600

security vulnerability

cve-2021-37471

netcloud manager

ssh command-line

CVSS2

7.8

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

7.3

Confidence

High

EPSS

0.001

Percentile

49.2%

JSON

Cradlepoint IBR900-600 devices running versions < 7.21.10 are vulnerable to a restricted shell escape sequence that provides an attacker the capability to simultaneously deny availability to the device’s NetCloud Manager console, local console and SSH command-line.

Affected configurations

Nvd

Node

cradlepointibr600cMatch-

AND

cradlepointibr600c_firmwareRange<7.21.0

Node

cradlepointibr600Match-

AND

cradlepointibr600_firmwareRange<7.21.0

Node

cradlepointibr900Match-

AND

cradlepointibr900_firmwareRange<7.21.0

VendorProductVersionCPE
cradlepointibr600c-cpe:2.3:h:cradlepoint:ibr600c:-:*:*:*:*:*:*:*
cradlepointibr600c_firmware*cpe:2.3:o:cradlepoint:ibr600c_firmware:*:*:*:*:*:*:*:*
cradlepointibr600-cpe:2.3:h:cradlepoint:ibr600:-:*:*:*:*:*:*:*
cradlepointibr600_firmware*cpe:2.3:o:cradlepoint:ibr600_firmware:*:*:*:*:*:*:*:*
cradlepointibr900-cpe:2.3:h:cradlepoint:ibr900:-:*:*:*:*:*:*:*
cradlepointibr900_firmware*cpe:2.3:o:cradlepoint:ibr900_firmware:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
cradlepoint	ibr600c	-	cpe:2.3:h:cradlepoint:ibr600c:-:::::::*
cradlepoint	ibr600c_firmware	*	cpe:2.3:o:cradlepoint:ibr600c_firmware::::::::
cradlepoint	ibr600	-	cpe:2.3:h:cradlepoint:ibr600:-:::::::*
cradlepoint	ibr600_firmware	*	cpe:2.3:o:cradlepoint:ibr600_firmware::::::::
cradlepoint	ibr900	-	cpe:2.3:h:cradlepoint:ibr900:-:::::::*
cradlepoint	ibr900_firmware	*	cpe:2.3:o:cradlepoint:ibr900_firmware::::::::

References

cradlepoint.com/product/endpoints/ibr900/

securitybytes.me/posts/cve-2021-37471/

CVSS2

7.8

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

7.3

Confidence

High

EPSS

0.001

Percentile

49.2%

JSON

Related for CVE-2021-37471