Vulnerability CVE-2021-39291


Published: 2021-08-23

Description:
Certain NetModule devices allow credentials via GET parameters to CLI-PHP. These models with firmware before 4.3.0.113, 4.4.0.111, and 4.5.0.105 are affected: NB800, NB1600, NB1601, NB1800, NB1810, NB2700, NB2710, NB2800, NB2810, NB3700, NB3701, NB3710, NB3711, NB3720, and NB3800.

See advisories in our WLB2 database:
Topic
Author
Date
Med.
NetModule Router Software Password Handling / Session Fixation
Gerhard Hechenbe...
21.08.2021

Type:

CWE-863

(Incorrect Authorization)

CVSS2 => (AV:N/AC:L/Au:S/C:P/I:P/A:P)

CVSS Base Score
Impact Subscore
Exploitability Subscore
6.5/10
6.4/10
8/10
Exploit range
Attack complexity
Authentication
Remote
Low
Single time
Confidentiality impact
Integrity impact
Availability impact
Partial
Partial
Partial

 References:
https://seclists.org/fulldisclosure/2021/Aug/22
https://www.netmodule.com

Copyright 2021, cxsecurity.com

 

Back to Top