PT-2021-16749 · Adtran · Netvanta 7060+2

Casey Erdmann · Published 2021-04-20 · Updated 2024-08-03 · CVE-2021-25679

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions AdTran Personal Phone Manager versions 10.8.1 and earlier

Description The AdTran Personal Phone Manager software is vulnerable to an authenticated stored cross-site scripting (XSS) issue. This issue impacts versions 10.8.1 and below, and potentially later versions as well, since they have not previously been disclosed. The affected appliances, NetVanta 7060 and NetVanta 7100, are considered End of Life and will not be patched.

Recommendations For versions 10.8.1 and earlier, as the affected appliances are End of Life and will not receive a patch, consider disabling the software or restricting access to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-25679

Affected Products

Adtran Personal Phone Manager

Netvanta 7060

Netvanta 7100

References · 9

• 🔥 https://github.com/3ndG4me/AdTran-Personal-Phone-Manager-Vulns/blob/main/CVE-2021-25679.md · Exploit
• 🔥 https://github.com/3ndG4me/AdTran-Personal-Phone-Manager-Vulns · Exploit
• 🔥 https://exploit-db.com/exploits/49785 · Exploit
• 🔥 http://packetstormsecurity.com/files/162268/Adtran-Personal-Phone-Manager-10.8.1-Persistent-Cross-Site-Scripting.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-25679 · Security Note
• http://adtran.com · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-25679 · Vendor Advisory
• https://t.me/cvenotify/88839 · Telegram Post
• https://depthsecurity.com/blog/vulnerability-disclosure · Note