PT-2021-18632 · Dma Softlab · Dma Softlab Radius Manager

Published 2021-04-07 · Updated 2021-04-12 · CVE-2021-30147

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions DMA Softlab Radius Manager version 4.4.0

Description The issue allows for Cross-Site Request Forgery (CSRF) attacks, which can lead to impacts such as adding new manager accounts via the admin.php endpoint. The estimated number of potentially affected devices worldwide is not specified. There is no information provided about real-world incidents where this issue was exploited.

Recommendations For DMA Softlab Radius Manager version 4.4.0, consider disabling access to the admin.php endpoint until a fix is available to prevent CSRF attacks. As a temporary workaround, restrict the ability to add new manager accounts to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2021-30147

Affected Products

Dma Softlab Radius Manager

References · 10

• 🔥 https://github.com/1d8/publications/tree/main/cve-2021-30147 · Exploit
• 🔥 http://packetstormsecurity.com/files/162136/DMA-Radius-Manager-4.4.0-Cross-Site-Request-Forgery.html · Exploit
• 🔥 https://exploit-db.com/exploits/49752 · Exploit
• https://cve.org/CVERecord?id=CVE-2021-30147 · Security Note
• https://osv.dev/vulnerability/CVE-2021-30147 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-30147 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-30147 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-30147 · Vendor Advisory
• https://t.me/cvenotify/12781 · Telegram Post
• http://dmasoftlab.com · Note