CVE-2021-40857

🗓️ 13 Dec 2021 03:24:17Reported by mitreType

cve

cve🔗 web.nvd.nist.gov👁 76 Views🌐 WEB

Auerswald COMpact 5500R devices before 8.2B privilege escalation vulnerabilit

Reporter	Title	Published	Views	Family All 11
0day.today	Auerswald COMpact 8.0B - Privilege Escalation Vulnerability	6 Dec 202100:00	–	zdt
Circl	CVE-2021-40857	13 Dec 202107:13	–	circl
CNNVD	Auerswald Compact 系列安全漏洞	6 Dec 202100:00	–	cnnvd
CNVD	Auerswald COMpact 5500R Elevation of Privilege Vulnerability	9 Dec 202100:00	–	cnvd
Cvelist	CVE-2021-40857	13 Dec 202103:24	–	cvelist
Exploit DB	Auerswald COMpact 8.0B - Privilege Escalation	6 Dec 202100:00	–	exploitdb
EUVD	EUVD-2021-28013	3 Oct 202520:07	–	euvd
NVD	CVE-2021-40857	13 Dec 202104:15	–	nvd
OSV	CVE-2021-40857	13 Dec 202104:15	–	osv
Packet Storm	Auerswald COMpact 8.0B Privilege Escalation	6 Dec 202100:00	–	packetstorm

NVD

Node

auerswald compact_5500r_ip_firmwareRange≤8.0b

AND

auerswald compact_5500r_ipMatch-

Node

auerswald compact_5200r_ip_firmwareRange≤8.0b

AND

auerswald compact_5200r_ipMatch-

Node

auerswald compact_5000r_ip_firmwareRange≤8.0b

AND

auerswald compact_5000r_ipMatch-

Node

auerswald compact_4000_ip_firmwareRange≤8.0b

AND

auerswald compact_4000r_ipMatch-

Node

auerswald commander_6000r_ip_firmwareRange≤8.0b

AND

auerswald commander_6000r_ipMatch-

Node

auerswald commander_6000rx_ip_firmwareRange≤8.0b

AND

auerswald commander_6000rx_ipMatch-

Node

auerswald commander_business(19")_ip_firmwareRange≤8.0b

AND

auerswald commander_business(19")_ipMatch-

Node

auerswald commander_basic.2(19")_ip_firmwareRange≤8.0b

AND

auerswald commander_basic.2(19")_ipMatch-

Node

auerswald compact_5010_voip_ip_firmwareRange≤8.0b

AND

auerswald compact_5010_voip_ipMatch-

Node

auerswald compact_5020_voip_ip_firmwareRange≤8.0b

AND

auerswald compact_5020_voip_ipMatch-

Source	Link
packetstormsecurity	www.packetstormsecurity.com/files/165163/Auerswald-COMpact-8.0B-Privilege-Escalation.html
redteam-pentesting	www.redteam-pentesting.de/en/advisories/-advisories-publicised-vulnerability-analyses
redteam-pentesting	www.redteam-pentesting.de/advisories/rt-sa-2021-005

Parameter	Position	Path	Description	CWE
tnId	query param	/teilnehmer_profil_einzel_state	Privilege escalation: requesting user profile with passwd=1 returns plaintext passwords for user accounts.	CWE-522
passwd	query param	/teilnehmer_profil_einzel_state	Privilege escalation: requesting user profile with passwd=1 returns plaintext passwords for user accounts.	CWE-522

21 Nov 2024 06:24Current

8.7High risk

Vulners AI Score8.7

CVSS 26.5

CVSS 3.18.8

EPSS0.01393

auerswald compact 5500r devices vulnerability privilege escalation cve-2021-40857 nvd