Lucene search

MitreCVE-2021-45878

HistoryMar 21, 2022 - 11:15 a.m.

CVE-2021-45878

2022-03-2111:15:10

CWE-306

mitre

web.nvd.nist.gov

cve-2021-45878

garo

wallbox

glb

gtb

gtc

improper access control

web manager pages

security vulnerability

CVSS2

6.4

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:P/A:N

CVSS3

9.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

AI Score

Confidence

High

EPSS

0.002

Percentile

51.7%

JSON

Multiple versions of GARO Wallbox GLB/GTB/GTC are affected by incorrect access control. Lack of access control on the web manger pages allows any user to view and modify information.

Affected configurations

Nvd

Node

garowallbox_gtb_firmwareRange≤185

AND

garowallbox_gtbMatch-

Node

garowallbox_gtc_firmwareRange≤185

AND

garowallbox_gtcMatch-

Node

garowallbox_glb_firmwareRange≤185

AND

garowallbox_glbMatch-

VendorProductVersionCPE
garowallbox_gtb_firmware*cpe:2.3:o:garo:wallbox_gtb_firmware:*:*:*:*:*:*:*:*
garowallbox_gtb-cpe:2.3:h:garo:wallbox_gtb:-:*:*:*:*:*:*:*
garowallbox_gtc_firmware*cpe:2.3:o:garo:wallbox_gtc_firmware:*:*:*:*:*:*:*:*
garowallbox_gtc-cpe:2.3:h:garo:wallbox_gtc:-:*:*:*:*:*:*:*
garowallbox_glb_firmware*cpe:2.3:o:garo:wallbox_glb_firmware:*:*:*:*:*:*:*:*
garowallbox_glb-cpe:2.3:h:garo:wallbox_glb:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
garo	wallbox_gtb_firmware	*	cpe:2.3:o:garo:wallbox_gtb_firmware::::::::
garo	wallbox_gtb	-	cpe:2.3:h:garo:wallbox_gtb:-:::::::*
garo	wallbox_gtc_firmware	*	cpe:2.3:o:garo:wallbox_gtc_firmware::::::::
garo	wallbox_gtc	-	cpe:2.3:h:garo:wallbox_gtc:-:::::::*
garo	wallbox_glb_firmware	*	cpe:2.3:o:garo:wallbox_glb_firmware::::::::
garo	wallbox_glb	-	cpe:2.3:h:garo:wallbox_glb:-:::::::*

References

github.com/delikely/advisory/tree/main/GARO

CVSS2

6.4

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:P/A:N

CVSS3

9.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

AI Score

Confidence

High

EPSS

0.002

Percentile

51.7%

JSON

Related for CVE-2021-45878