Lucene search

NozomiCVELIST:CVE-2021-26733

HistoryOct 24, 2022 - 12:00 a.m.

CVE-2021-26733 spx_restservice FirstReset_handler_func Broken Access Control

2022-10-2400:00:00

CWE-284

Nozomi

www.cve.org

cve-2021-26733 spx_restservice denial-of-service lanner inc iac-ast2500a standard firmware 1.10.0 broken access control

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

EPSS

0.001

Percentile

39.2%

JSON

A broken access control vulnerability in the FirstReset_handler_func function of spx_restservice allows an attacker to arbitrarily send reboot commands to the BMC, causing a Denial-of-Service (DoS) condition. This issue affects: Lanner Inc IAC-AST2500A standard firmware version 1.10.0.

CNA Affected

[
  {
    "vendor": "Lanner Inc",
    "product": "IAC-AST2500A",
    "versions": [
      {
        "version": "1.10.0",
        "status": "affected"
      }
    ]
  }
]

References

www.nozominetworks.com/blog/vulnerabilities-in-bmc-firmware-affect-ot-iot-device-security-part-1/

www.nozominetworks.com/labs/vulnerability-advisories/cve-2021-26733/

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

EPSS

0.001

Percentile

39.2%

JSON

Related for CVELIST:CVE-2021-26733