CVE-2021-44467

🗓️ 24 Oct 2022 00:00:00Reported by NozomiType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 60 Views

A broken access control vulnerability in KillDupUsr_func function of spx_restservice allows an attacker to arbitrarily terminate active sessions of other users, causing a Denial-of-Service (DoS) condition. This issue affects: Lanner Inc IAC-AST2500A standard firmware version 1.10.0

Reporter	Title	Published	Views	Family All 10
Circl	CVE-2021-44467	24 Oct 202218:26	–	circl
CNNVD	Lanner IAC-AST2500A 安全漏洞	24 Oct 202200:00	–	cnnvd
Cvelist	CVE-2021-44467 spx_restservice KillDupUsr_func Broken Access Control	24 Oct 202200:00	–	cvelist
EUVD	EUVD-2021-31304	3 Oct 202520:07	–	euvd
NVD	CVE-2021-44467	24 Oct 202214:15	–	nvd
OSV	CVE-2021-44467	24 Oct 202214:15	–	osv
Prion	Improper access control	24 Oct 202214:15	–	prion
Positive Technologies	PT-2022-12125 · Lanner · Iac-Ast2500A	24 Oct 202200:00	–	ptsecurity
The Hacker News	Over a Dozen New BMC Firmware Flaws Expose OT and IoT Devices to Remote Attacks	28 Nov 202210:07	–	thn
Vulnrichment	CVE-2021-44467 spx_restservice KillDupUsr_func Broken Access Control	24 Oct 202200:00	–	vulnrichment

NVD

Node

lannerinc iac-ast2500a_firmwareMatch1.10.0

AND

lannerinc iac-ast2500aMatch-

[
  {
    "defaultStatus": "unaffected",
    "product": "IAC-AST2500A",
    "vendor": "Lanner Inc",
    "versions": [
      {
        "status": "affected",
        "version": "1.10.0"
      }
    ]
  }
]

Source	Link
nozominetworks	www.nozominetworks.com/blog/vulnerabilities-in-bmc-firmware-affect-ot-iot-device-security-part-1/
nozominetworks	www.nozominetworks.com/labs/vulnerability-advisories/cve-2021-44467/

21 Nov 2024 06:31Current

6.3Medium risk

Vulners AI Score6.3

CVSS 3.15.3 - 7.5

EPSS0.00237

SSVC

CWE-284