CVE-2021-44776

spx_restservice SubNet_handler_func Broken Access Control

A broken access control vulnerability in the SubNet_handler_func function of spx_restservice allows an attacker to arbitrarily change the security access rights to KVM and Virtual Media functionalities. This issue affects: Lanner Inc IAC-AST2500A standard firmware version 1.10.0.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Lannerinc

Products

Iac-ast2500a Iac-ast2500a Firmware

CVE-2021-44769

TLS Certificate Generation Function Improper Input Validation

An improper input validation vulnerability in the TLS certificate generation function allows an attacker to cause a Denial-of-Service (DoS) condition which can only be reverted via a factory reset. This issue affects: Lanner Inc IAC-AST2500A standard firmware version 1.10.0.

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed

Vendors

Lannerinc

Products

Iac-ast2500a Iac-ast2500a Firmware

CVE-2021-44467

spx_restservice KillDupUsr_func Broken Access Control

A broken access control vulnerability in the KillDupUsr_func function of spx_restservice allows an attacker to arbitrarily terminate active sessions of other users, causing a Denial-of-Service (DoS) condition, if an input parameter is correctly guessed. This issue affects: Lanner Inc IAC-AST2500A standard firmware version 1.10.0.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Lannerinc

Products

Iac-ast2500a Iac-ast2500a Firmware

CVE-2021-26733

spx_restservice FirstReset_handler_func Broken Access Control

A broken access control vulnerability in the FirstReset_handler_func function of spx_restservice allows an attacker to arbitrarily send reboot commands to the BMC, causing a Denial-of-Service (DoS) condition. This issue affects: Lanner Inc IAC-AST2500A standard firmware version 1.10.0.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Lannerinc

Products

Iac-ast2500a Iac-ast2500a Firmware

CVE-2021-26732

spx_restservice First_network_func Broken Access Control

A broken access control vulnerability in the First_network_func function of spx_restservice allows an attacker to arbitrarily change the network configuration of the BMC. This issue affects: Lanner Inc IAC-AST2500A standard firmware version 1.10.0.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Lannerinc

Products

Iac-ast2500a Iac-ast2500a Firmware

CVE-2021-26731

spx_restservice modifyUserb_func Command Injection and Multiple Stack-Based Buffer Overflows

Command injection and multiple stack-based buffer overflows vulnerabilities in the modifyUserb_func function of spx_restservice allow an authenticated attacker to execute arbitrary code with the same privileges as the server user (root). This issue affects: Lanner Inc IAC-AST2500A standard firmware version 1.10.0.

CVSS 3.1 · 9.1 Critical EPSS 2.7% KEV · Not listed

Vendors

Lannerinc

Products

Iac-ast2500a Iac-ast2500a Firmware

CVE-2021-26730

spx_restservice Login_handler_func Subfunction Stack-Based Buffer Overflow

A stack-based buffer overflow vulnerability in a subfunction of the Login_handler_func function of spx_restservice allows an attacker to execute arbitrary code with the same privileges as the server user (root). This issue affects: Lanner Inc IAC-AST2500A standard firmware version 1.10.0.

CVSS 3.1 · 10 Critical EPSS 1.3% KEV · Not listed

Vendors

Lannerinc

Products

Iac-ast2500a Iac-ast2500a Firmware

CVE-2021-26729

spx_restservice Login_handler_func Command Injection and Multiple Stack-Based Buffer Overflows

Command injection and multiple stack-based buffer overflows vulnerabilities in the Login_handler_func function of spx_restservice allow an attacker to execute arbitrary code with the same privileges as the server user (root). This issue affects: Lanner Inc IAC-AST2500A standard firmware version 1.10.0.

CVSS 3.1 · 10 Critical EPSS 2.7% KEV · Not listed

Vendors

Lannerinc

Products

Iac-ast2500a Iac-ast2500a Firmware

CVE-2021-26727

spx_restservice SubNet_handler_func Multiple Command Injections and Stack-Based Buffer Overflows

Multiple command injections and stack-based buffer overflows vulnerabilities in the SubNet_handler_func function of spx_restservice allow an attacker to execute arbitrary code with the same privileges as the server user (root). This issue affects: Lanner Inc IAC-AST2500A standard firmware version 1.10.0.

CVSS 3.1 · 10 Critical EPSS 2.7% KEV · Not listed

Vendors

Lannerinc

Products

Iac-ast2500a Iac-ast2500a Firmware

CVE-2021-45925

Username Enumeration

Observable discrepancies in the login process allow an attacker to guess legitimate user names registered in the BMC. This issue affects: Lanner Inc IAC-AST2500A standard firmware version 1.10.0.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Lannerinc

Products

Iac-ast2500a Iac-ast2500a Firmware

CVE-2021-46279

Session Fixation and Insufficient Session Expiration

Session fixation and insufficient session expiration vulnerabilities allow an attacker to perfom session hijacking attacks against users. This issue affects: Lanner Inc IAC-AST2500A standard firmware version 1.10.0.

CVSS 3.1 · 5.8 Medium EPSS < 1% KEV · Not listed

Vendors

Lannerinc

Products

Iac-ast2500a Iac-ast2500a Firmware

CVE-2021-4228

Hard-coded TLS Certificate

Use of hard-coded TLS certificate by default allows an attacker to perform Man-in-the-Middle (MitM) attacks even in the presence of the HTTPS connection. This issue affects: Lanner Inc IAC-AST2500A standard firmware version 1.00.0.

CVSS 3.1 · 5.8 Medium EPSS 10.2% KEV · Not listed

Vendors

Lannerinc

Products

Iac-ast2500 Iac-ast2500 Firmware

CVE-2021-26728

spx_restservice KillDupUsr_func Command Injection and Stack-Based Buffer Overflow

Command injection and stack-based buffer overflow vulnerabilities in the KillDupUsr_func function of spx_restservice allow an attacker to execute arbitrary code with the same privileges as the server user (root). This issue affects: Lanner Inc IAC-AST2500A standard firmware version 1.10.0.

CVSS 3.1 · 10 Critical EPSS 2.7% KEV · Not listed

Vendors

Lannerinc

Products

Iac-ast2500a Iac-ast2500a Firmware