CVE-2021-3252

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "descriptions": [{"lang": "en", "value": "KACO New Energy XP100U Up to XP-JAVA 2.0 is affected by incorrect access control. Credentials will always be returned in plain-text from the local server during the KACO XP100U authentication process, regardless of whatever passwords have been provided, which leads to an information disclosure vulnerability."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2021-02-23T14:15:32.000Z", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://us-cert.cisa.gov/ics/alerts/ICS-ALERT-15-224-01"}, {"tags": ["x_refsource_MISC"], "url": "https://twitter.com/Kevin2600/status/1351189347501023238"}, {"tags": ["x_refsource_MISC"], "url": "https://tiger-team-1337.blogspot.com/2021/01/kaco-xp100u-hmi-credential-leak.html"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2021-3252", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "KACO New Energy XP100U Up to XP-JAVA 2.0 is affected by incorrect access control. Credentials will always be returned in plain-text from the local server during the KACO XP100U authentication process, regardless of whatever passwords have been provided, which leads to an information disclosure vulnerability."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "https://us-cert.cisa.gov/ics/alerts/ICS-ALERT-15-224-01", "refsource": "MISC", "url": "https://us-cert.cisa.gov/ics/alerts/ICS-ALERT-15-224-01"}, {"name": "https://twitter.com/Kevin2600/status/1351189347501023238", "refsource": "MISC", "url": "https://twitter.com/Kevin2600/status/1351189347501023238"}, {"name": "https://tiger-team-1337.blogspot.com/2021/01/kaco-xp100u-hmi-credential-leak.html", "refsource": "MISC", "url": "https://tiger-team-1337.blogspot.com/2021/01/kaco-xp100u-hmi-credential-leak.html"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T16:53:16.506Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://us-cert.cisa.gov/ics/alerts/ICS-ALERT-15-224-01"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://twitter.com/Kevin2600/status/1351189347501023238"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://tiger-team-1337.blogspot.com/2021/01/kaco-xp100u-hmi-credential-leak.html"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2021-3252", "datePublished": "2021-02-23T14:15:32.000Z", "dateReserved": "2021-01-22T00:00:00.000Z", "dateUpdated": "2024-08-03T16:53:16.506Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"affected": [{"affectedData": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "source": "cve@mitre.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:kaco-newenergy:xp100u_firmware:xp-java_2.0:*:*:*:*:*:*:*", "matchCriteriaId": "E7433757-F3B9-491B-8543-73D5D25F3FE8", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:kaco-newenergy:xp100u:-:*:*:*:*:*:*:*", "matchCriteriaId": "4319EC8B-12C1-418E-B20C-9FA05648A0A6", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "KACO New Energy XP100U Up to XP-JAVA 2.0 is affected by incorrect access control. Credentials will always be returned in plain-text from the local server during the KACO XP100U authentication process, regardless of whatever passwords have been provided, which leads to an information disclosure vulnerability."}, {"lang": "es", "value": "KACO New Energy XP100U versiones hasta XP-JAVA 2.0, est\u00e1 afectado por un control de acceso incorrecto. Unas credenciales siempre ser\u00e1n devueltas en texto plano desde el servidor local durante el proceso de autenticaci\u00f3n de KACO XP100U, independientemente de las contrase\u00f1as que hayan sido proporcionadas, lo que conlleva a una vulnerabilidad de divulgaci\u00f3n de informaci\u00f3n"}], "id": "CVE-2021-3252", "lastModified": "2026-06-17T04:04:51.427", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2021-02-23T15:15:15.967", "references": [{"source": "cve@mitre.org", "tags": ["Exploit", "Technical Description", "Third Party Advisory"], "url": "https://tiger-team-1337.blogspot.com/2021/01/kaco-xp100u-hmi-credential-leak.html"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory"], "url": "https://twitter.com/Kevin2600/status/1351189347501023238"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory", "US Government Resource"], "url": "https://us-cert.cisa.gov/ics/alerts/ICS-ALERT-15-224-01"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Technical Description", "Third Party Advisory"], "url": "https://tiger-team-1337.blogspot.com/2021/01/kaco-xp100u-hmi-credential-leak.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://twitter.com/Kevin2600/status/1351189347501023238"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory", "US Government Resource"], "url": "https://us-cert.cisa.gov/ics/alerts/ICS-ALERT-15-224-01"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-522"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{}