CVE-2021-20146

2021-12-0915:21:34

tenable

www.cve.org

ssh

private key

gryphon

root access

development server

amazon web services

AI Score

9.6

Confidence

High

EPSS

0.002

Percentile

61.1%

JSON

An unprotected ssh private key exists on the Gryphon devices which could be used to achieve root access to a server affiliated with Gryphon’s development and infrastructure. At the time of discovery, the ssh key could be used to login to the development server hosted in Amazon Web Services.

CNA Affected

[
  {
    "product": "Gryphon Tower router",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "<= 04.0004.12 (Current)"
      }
    ]
  }
]

References

www.tenable.com/security/research/tra-2021-51