CVE Feed

    Dashboard / CVE / CVE-2021-44467

    CVE-2021-44467

    A broken access control vulnerability in the KillDupUsr_func function of spx_restservice allows an attacker to arbitrarily terminate active sessions of other users, causing a Denial-of-Service (DoS) condition, if an input parameter is correctly guessed. This issue affects: Lanner Inc IAC-AST2500A standard firmware version 1.10.0.

    Published:Oct 24, 2022
    Last Modified:May 7, 2025
    EPS:Oct 24, 2022
    EPSS Score:0.00044
    CVSS Score:5.3

    Affected Products

    Vendor
    Lannerinc
    Product
    Iac-ast2500a
    Vendor
    Lannerinc
    Product
    Iac-ast2500a Firmware

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-284 Improper Access Control

    Related CVEs

    CVE-2021-44769 (CVSS 4.9) — An improper input validation vulnerability in the TLS certificate generation function allows an attacker to ca…
    CVE-2021-26727 (CVSS 10) — Multiple command injections and stack-based buffer overflows vulnerabilities in the SubNet_handler_func functi…
    CVE-2021-26728 (CVSS 10) — Command injection and stack-based buffer overflow vulnerabilities in the KillDupUsr_func function of spx_rests…
    CVE-2021-26731 (CVSS 9.1) — Command injection and multiple stack-based buffer overflows vulnerabilities in the modifyUserb_func function o…
    CVE-2021-26730 (CVSS 10) — A stack-based buffer overflow vulnerability in a subfunction of the Login_handler_func function of spx_restser…
    CVE-2021-26732 (CVSS 6.5) — A broken access control vulnerability in the First_network_func function of spx_restservice allows an attacker…
    CVE-2021-45925 (CVSS 5.3) — Observable discrepancies in the login process allow an attacker to guess legitimate user names registered in t…
    CVE-2021-44776 (CVSS 6.5) — A broken access control vulnerability in the SubNet_handler_func function of spx_restservice allows an attacke…
    CVE-2021-46279 (CVSS 5.8) — Session fixation and insufficient session expiration vulnerabilities allow an attacker to perfom session hijac…
    CVE-2021-26729 (CVSS 10) — Command injection and multiple stack-based buffer overflows vulnerabilities in the Login_handler_func function…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High