Lucene search

HackeroneCVE-2021-22909

HistoryMay 27, 2021 - 12:15 p.m.

CVE-2021-22909

2021-05-2712:15:08

CWE-300

CWE-295

hackerone

web.nvd.nist.gov

cve-2021-22909

edgemax

edgerouter

vulnerability

mitm

attack

firmware update

CVSS2

7.6

Attack Vector

NETWORK

Attack Complexity

HIGH

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:H/Au:N/C:C/I:C/A:C

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

0.003

Percentile

70.8%

JSON

A vulnerability found in EdgeMAX EdgeRouter V2.0.9 and earlier could allow a malicious actor to execute a man-in-the-middle (MitM) attack during a firmware update. This vulnerability is fixed in EdgeMAX EdgeRouter V2.0.9-hotfix.1 and later.

Affected configurations

Nvd

Vulners

Node

uiedgemax_edgerouter_firmwareRange≤2.0.9

AND

uiedgemax_edgerouterMatch-

VendorProductVersionCPE
uiedgemax_edgerouter_firmware*cpe:2.3:o:ui:edgemax_edgerouter_firmware:*:*:*:*:*:*:*:*
uiedgemax_edgerouter-cpe:2.3:h:ui:edgemax_edgerouter:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
ui	edgemax_edgerouter_firmware	*	cpe:2.3:o:ui:edgemax_edgerouter_firmware::::::::
ui	edgemax_edgerouter	-	cpe:2.3:h:ui:edgemax_edgerouter:-:::::::*

CNA Affected

[
  {
    "product": "EdgeMAX EdgeRouter",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Fixed Version: 2.0.9-hotfix.1 or later."
      }
    ]
  }
]

References

community.ui.com/releases/Security-Advisory-Bulletin-018-018/cfa1566b-4bf8-427b-8cc7-8cffba3a93a4

Social References

CVSS2

7.6

Attack Vector

NETWORK

Attack Complexity

HIGH

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:H/Au:N/C:C/I:C/A:C

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

0.003

Percentile

70.8%

JSON

Related for CVE-2021-22909