CVE-2021-20643 - OpenCVE

Improper access control vulnerability in ELECOM LD-PS/U1 allows remote attackers to change the administrative password of the affected device by processing a specially crafted request.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

AV:N/AC:L/Au:N/C:N/I:P/A:N

Vendors & Products
CPE Configurations

Vendors	Products
Elecom	Ld-ps\/u1 Firmware Ld-ps\/u1

Configuration 1 [-]

AND

cpe:2.3:o:elecom:ld-ps\/u1_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:elecom:ld-ps\/u1:-:*:*:*:*:*:*:*

References

Link	Resource
https://jvn.jp/en/jp/JVN47580234/index.html	Third Party Advisory
https://www.elecom.co.jp/news/security/20210126-01/	Vendor Advisory

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: jpcert

Published: 2021-02-12T06:15:46

Updated: 2021-02-12T06:15:46

Reserved: 2020-12-17T00:00:00

Link: CVE-2021-20643

JSON object: View

NVD Information

Status : Analyzed

Published: 2021-02-12T07:15:14.997

Modified: 2022-07-12T17:42:04.277

Link: CVE-2021-20643

JSON object: View

Redhat Information

No data.

CWE

NVD-CWE-Other

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:elecom:ld-ps\\/u1_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "D7B30CAF-6AE0-4A8F-BB7F-8C2E6461E0AD", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:elecom:ld-ps\\/u1:-:*:*:*:*:*:*:*", "matchCriteriaId": "52A883B8-89B7-4348-BB0A-D8618207A83F", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "Improper access control vulnerability in ELECOM LD-PS/U1 allows remote attackers to change the administrative password of the affected device by processing a specially crafted request."}, {"lang": "es", "value": "La vulnerabilidad de control de acceso inapropiado en ELECOM LD-PS/U1, permite a atacantes remotos cambiar la contrase\u00f1a administrativa del dispositivo afectado al procesar una petici\u00f3n especialmente dise\u00f1ada"}], "id": "CVE-2021-20643", "lastModified": "2022-07-12T17:42:04.277", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2021-02-12T07:15:14.997", "references": [{"source": "vultures@jpcert.or.jp", "tags": ["Third Party Advisory"], "url": "https://jvn.jp/en/jp/JVN47580234/index.html"}, {"source": "vultures@jpcert.or.jp", "tags": ["Vendor Advisory"], "url": "https://www.elecom.co.jp/news/security/20210126-01/"}], "sourceIdentifier": "vultures@jpcert.or.jp", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}]}