PT-2021-17102 · Squarebox · Squarebox Catdv Server

Published 2021-03-05 · Updated 2021-03-13 · CVE-2021-26705

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions SquareBox CatDV Server versions through 9.2

Description An issue was discovered in SquareBox CatDV Server, where an attacker can invoke sensitive RMI methods, such as getConnections, without authentication. The results of these methods can be used to generate valid authentication tokens, which can then be used to invoke administrative tasks within the application, such as disclosing password hashes.

Recommendations For SquareBox CatDV Server versions through 9.2, consider disabling the getConnections method until a patch is available to prevent unauthorized access to sensitive information. Restrict access to administrative tasks to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2021-26705

Affected Products

Squarebox Catdv Server

References · 5

• 🔥 https://exploit-db.com/exploits/49621 · Exploit
• https://osv.dev/vulnerability/CVE-2021-26705 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-26705 · Security Note
• https://t.me/cvenotify/11292 · Telegram Post
• https://t.me/cibsecurity/24557 · Telegram Post