CVE Feed

    Dashboard / CVE / CVE-2021-40858

    CVE-2021-40858

    Auerswald COMpact 5500R devices before 8.2B allow Arbitrary File Disclosure. A sub-admin can read the cleartext Admin password via the fileName=../../etc/passwd substring.

    Published:Dec 13, 2021
    Last Modified:Nov 21, 2024
    EPS:Dec 13, 2021
    EPSS Score:0.01708
    CVSS Score:4.9

    Affected Products

    Vendor
    Auerswald
    Product
    Commander 6000r Ip
    Vendor
    Auerswald
    Product
    Commander 6000r Ip Firmware
    Vendor
    Auerswald
    Product
    Commander 6000rx Ip
    Vendor
    Auerswald
    Product
    Commander 6000rx Ip Firmware
    Vendor
    Auerswald
    Product
    Commander Basic.2\(19\"\) Ip
    Vendor
    Auerswald
    Product
    Commander Basic.2\(19\"\) Ip Firmware
    Vendor
    Auerswald
    Product
    Commander Business\(19\"\) Ip
    Vendor
    Auerswald
    Product
    Commander Business\(19\"\) Ip Firmware
    Vendor
    Auerswald
    Product
    Compact 4000 Ip Firmware
    Vendor
    Auerswald
    Product
    Compact 4000r Ip
    Vendor
    Auerswald
    Product
    Compact 5000r Ip
    Vendor
    Auerswald
    Product
    Compact 5000r Ip Firmware
    Vendor
    Auerswald
    Product
    Compact 5010 Voip Ip
    Vendor
    Auerswald
    Product
    Compact 5010 Voip Ip Firmware
    Vendor
    Auerswald
    Product
    Compact 5020 Voip Ip
    Vendor
    Auerswald
    Product
    Compact 5020 Voip Ip Firmware
    Vendor
    Auerswald
    Product
    Compact 5200r Ip
    Vendor
    Auerswald
    Product
    Compact 5200r Ip Firmware
    Vendor
    Auerswald
    Product
    Compact 5500r Ip
    Vendor
    Auerswald
    Product
    Compact 5500r Ip Firmware

    Exploits

    http://packetstormsecurity.com/files/165166/Auerswald-COMpact-8.0B-Arbitrary-File-Disclosure.htmlhttps://www.redteam-pentesting.de/advisories/rt-sa-2021-006https://www.redteam-pentesting.de/en/advisories/-advisories-publicised-vulnerability-analyseshttp://packetstormsecurity.com/files/165166/Auerswald-COMpact-8.0B-Arbitrary-File-Disclosure.htmlhttps://www.redteam-pentesting.de/advisories/rt-sa-2021-006https://www.redteam-pentesting.de/en/advisories/-advisories-publicised-vulnerability-analyses

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High