PT-2021-17419 · Realtek · Realtek Xpon Rtl9601D Sdk

Published 2021-03-25 · Updated 2021-03-30 · CVE-2021-27372

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Realtek xPON RTL9601D SDK version 1.9

Description The issue allows attackers to possibly gain access to the device with root permissions via the built-in network monitoring tool and execute arbitrary commands, as passwords are stored in plaintext.

Recommendations For Realtek xPON RTL9601D SDK version 1.9, consider restricting access to the built-in network monitoring tool to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

CVE-2021-27372

Affected Products

Realtek Xpon Rtl9601D Sdk

References · 5

• https://realtek.com/images/safe-report/RTL9601D_CVE-2021-27372.pdf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-27372 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-27372 · Security Note
• https://t.me/cvenotify/11980 · Telegram Post
• https://t.me/cvenotify/12342 · Telegram Post