Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2021-20151

Trendnet AC2600 TEW-827DRU version 2.08B01 contains a flaw in the session management for the device. The router's management software manages web sessions based on IP address rather than verifying client cookies/session tokens/etc. This allows an attacker (whether from a different computer, different web browser on the same machine, etc.) to take over an existing session. This does require the attacker to be able to spoof or take over original IP address of the original user's session.

Published

2021-12-30T22:15:08.670

Last Modified

2024-11-21T05:46:01.250

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 10.0 (CRITICAL)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: PARTIAL
  • Availability Impact: PARTIAL
Exploitability Score

10.0

Impact Score

6.4

Weaknesses
  • Type: Primary
    CWE-384
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Operating System trendnet tew-827dru_firmware 2.08b01 Yes
Hardware trendnet tew-827dru 2.0 No
References