Lucene search

NozomiCVELIST:CVE-2021-26732

HistoryOct 24, 2022 - 12:00 a.m.

CVE-2021-26732 spx_restservice First_network_func Broken Access Control

2022-10-2400:00:00

CWE-284

Nozomi

www.cve.org

cve-2021-26732; spx_restservice; broken access control; first_network_func; lanner inc iac-ast2500a; standard firmware version 1.10.0

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

AI Score

6.6

Confidence

High

EPSS

0.001

Percentile

26.2%

JSON

A broken access control vulnerability in the First_network_func function of spx_restservice allows an attacker to arbitrarily change the network configuration of the BMC. This issue affects: Lanner Inc IAC-AST2500A standard firmware version 1.10.0.

CNA Affected

[
  {
    "vendor": "Lanner Inc",
    "product": "IAC-AST2500A",
    "versions": [
      {
        "version": "1.10.0",
        "status": "affected"
      }
    ]
  }
]

References

www.nozominetworks.com/blog/vulnerabilities-in-bmc-firmware-affect-ot-iot-device-security-part-1/

www.nozominetworks.com/labs/vulnerability-advisories/cve-2021-26732/

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

AI Score

6.6

Confidence

High

EPSS

0.001

Percentile

26.2%

JSON

Related for CVELIST:CVE-2021-26732