CVE-2021-44776

🗓️ 24 Oct 2022 00:00:00Reported by NozomiType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 49 Views

A broken access control vulnerability in the SubNet_handler_func function of spx_restservice allows an attacker to arbitrarily change the security access rights to KVM and Virtual Media functionalities. This issue affects: Lanner Inc IAC-AST2500A standard firmware version 1.10.0

Reporter	Title	Published	Views	Family All 9
Circl	CVE-2021-44776	24 Oct 202218:25	–	circl
CNNVD	Lanner IAC-AST2500A 安全漏洞	24 Oct 202200:00	–	cnnvd
Cvelist	CVE-2021-44776 spx_restservice SubNet_handler_func Broken Access Control	24 Oct 202200:00	–	cvelist
EUVD	EUVD-2021-31581	3 Oct 202520:07	–	euvd
NVD	CVE-2021-44776	24 Oct 202214:15	–	nvd
OSV	CVE-2021-44776	24 Oct 202214:15	–	osv
Prion	Improper access control	24 Oct 202214:15	–	prion
Positive Technologies	PT-2022-12229 · Lanner · Lanner Inc Iac-Ast2500A	24 Oct 202200:00	–	ptsecurity
Vulnrichment	CVE-2021-44776 spx_restservice SubNet_handler_func Broken Access Control	24 Oct 202200:00	–	vulnrichment

NVD

Node

lannerinc iac-ast2500a_firmwareMatch1.10.0

AND

lannerinc iac-ast2500aMatch-

[
  {
    "vendor": "Lanner Inc",
    "product": "IAC-AST2500A",
    "versions": [
      {
        "version": "1.10.0",
        "status": "affected"
      }
    ]
  }
]

Source	Link
nozominetworks	www.nozominetworks.com/labs/vulnerability-advisories/cve-2021-44776/
nozominetworks	www.nozominetworks.com/blog/vulnerabilities-in-bmc-firmware-affect-ot-iot-device-security-part-1/