CVE-2021-44467 spx_restservice KillDupUsr_func Broken Access Control

A broken access control vulnerability in the KillDupUsrfunc function of spxrestservice allows an attacker to arbitrarily terminate active sessions of other users, causing a Denial-of-Service DoS condition, if an input parameter is correctly guessed. This issue affects: Lanner Inc IAC-AST2500A...

CVE-2021-44467

CVE-2021-44467 affects Lanner IAC-AST2500A standard firmware 1.10.0 and involves a broken access control in spx_restservice KillDupUsr_func that can terminate other users’ active sessions, enabling DoS. Some sources note it could be chained with CVE-2021-26728 to enable remote code execution with...