Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2021-38412

Properly formatted POST requests to multiple resources on the HTTP and HTTPS web servers of the Digi PortServer TS 16 Rack device do not require authentication or authentication tokens. This vulnerability could allow an attacker to enable the SNMP service and manipulate the community strings to achieve further control in.

Published

2021-09-17T20:15:07.647

Last Modified

2024-11-21T06:17:02.130

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 9.6 (CRITICAL)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: PARTIAL
  • Availability Impact: PARTIAL
Exploitability Score

10.0

Impact Score

6.4

Weaknesses
  • Type: Secondary
    CWE-287
  • Type: Primary
    CWE-306
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Operating System digi portserver_ts_16_firmware 82000684 Yes
Operating System digi portserver_ts_16_firmware 82000685 Yes
Hardware digi portserver_ts_16 - No
References