PT-2021-13802 · Unknown · Gryphon Tower

Published 2021-12-09 · Updated 2021-12-13 · CVE-2021-20145

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Gryphon Tower routers (affected versions not specified)

Description: The issue concerns an unprotected openvpn configuration file in Gryphon Tower routers, which can allow attackers to access the Gryphon homebound VPN network. This exposure can lead to the LAN interfaces of other users' devices connected to the same service being accessible. An attacker could leverage this to make configuration changes to, or otherwise attack victims' devices as though they were on an adjacent network.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2021-20145

Affected Products

Gryphon Tower

References · 4

• 🔥 https://tenable.com/security/research/tra-2021-51 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-20145 · Security Note
• https://osv.dev/vulnerability/CVE-2021-20145 · Vendor Advisory
• https://t.me/cibsecurity/33699 · Telegram Post