CVE-2021-40856 :: Enginsight Vulnerability Database

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	NIST	7.5 HIGH	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
mitre	CNA	---				---
CVE	ADP	---				---

Base Score

CVSS 3.x

EPSS Score

Percentile: 98%

Vendor	Product	Version
auerswald	comfortel_3600_ip_firmware	𝑥 ≤ 2.8f
auerswald	comfortel_2600_ip_firmware	𝑥 ≤ 2.8f
auerswald	comfortel_1400_ip_firmware	𝑥 ≤ 2.8f

𝑥

= Vulnerable software versions

Known Exploits!

Common Weakness Enumeration

CWE-706 - Use of Incorrectly-Resolved Name or Reference
The software uses a name or reference to access a resource, but the name/reference resolves to a resource that is outside of the intended control sphere.

References

http://packetstormsecurity.com/files/165162/Auerswald-COMfortel-1400-2600-3600-IP-2.8F-Authentication-Bypass.html

https://www.redteam-pentesting.de/en/advisories/-advisories-publicised-vulnerability-analyses

https://www.redteam-pentesting.de/en/advisories/rt-sa-2021-004/-auerswald-comfortel-1400-2600-3600-ip-authentication-bypass

http://packetstormsecurity.com/files/165162/Auerswald-COMfortel-1400-2600-3600-IP-2.8F-Authentication-Bypass.html

https://www.redteam-pentesting.de/en/advisories/-advisories-publicised-vulnerability-analyses

https://www.redteam-pentesting.de/en/advisories/rt-sa-2021-004/-auerswald-comfortel-1400-2600-3600-ip-authentication-bypass