PT-2021-21319 · Prolink · Prolink Prc2402M

Ayrx · Published 2021-08-06 · Updated 2021-08-12 · CVE-2021-36708

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions ProLink PRC2402M versions 1.0.18 and older

Description The issue allows an attacker to reset the password to the administrative interface of the router. This is possible due to a problem in the set sys init function in the login.cgi binary.

Recommendations For ProLink PRC2402M versions 1.0.18 and older, consider disabling the set sys init function in the login.cgi binary as a temporary workaround until a patch is available. Restrict access to the administrative interface to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-640

Related Identifiers

CVE-2021-36708

Affected Products

Prolink Prc2402M

References · 5

• 🔥 https://ayrx.me/prolink-prc2402m-multiple-vulnerabilities/#sysinit-password-reset · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-36708 · Security Note
• https://osv.dev/vulnerability/CVE-2021-36708 · Vendor Advisory
• https://t.me/cibsecurity/26949 · Telegram Post
• https://t.me/cvenotify/18779 · Telegram Post