PT-2021-22507 · Netmodule · Netmodule Nb2700+14

Gerhard Hechenberger + 1 · Published 2021-08-23 · Updated 2023-11-02 · CVE-2021-39289

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions NetModule NB800 versions prior to 4.3.0.113 NetModule NB1600 versions prior to 4.3.0.113 NetModule NB1601 versions prior to 4.3.0.113 NetModule NB1800 versions prior to 4.3.0.113 NetModule NB1810 versions prior to 4.3.0.113 NetModule NB2700 versions prior to 4.3.0.113 NetModule NB2710 versions prior to 4.3.0.113 NetModule NB2800 versions prior to 4.4.0.111 NetModule NB2810 versions prior to 4.4.0.111 NetModule NB3700 versions prior to 4.5.0.105 NetModule NB3701 versions prior to 4.5.0.105 NetModule NB3710 versions prior to 4.5.0.105 NetModule NB3711 versions prior to 4.5.0.105 NetModule NB3720 versions prior to 4.5.0.105 NetModule NB3800 versions prior to 4.5.0.105

Description The issue concerns insecure password handling, where passwords are stored in cleartext or reversible encryption. This affects various NetModule devices with firmware versions before specific updates.

Recommendations For NetModule NB800, update to firmware version 4.3.0.113 or later. For NetModule NB1600, update to firmware version 4.3.0.113 or later. For NetModule NB1601, update to firmware version 4.3.0.113 or later. For NetModule NB1800, update to firmware version 4.3.0.113 or later. For NetModule NB1810, update to firmware version 4.3.0.113 or later. For NetModule NB2700, update to firmware version 4.3.0.113 or later. For NetModule NB2710, update to firmware version 4.3.0.113 or later. For NetModule NB2800, update to firmware version 4.4.0.111 or later. For NetModule NB2810, update to firmware version 4.4.0.111 or later. For NetModule NB3700, update to firmware version 4.5.0.105 or later. For NetModule NB3701, update to firmware version 4.5.0.105 or later. For NetModule NB3710, update to firmware version 4.5.0.105 or later. For NetModule NB3711, update to firmware version 4.5.0.105 or later. For NetModule NB3720, update to firmware version 4.5.0.105 or later. For NetModule NB3800, update to firmware version 4.5.0.105 or later.

Exploit

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

CVE-2021-39289

Affected Products

Netmodule Nb1600

Netmodule Nb1601

Netmodule Nb1800

Netmodule Nb1810

Netmodule Nb2700

Netmodule Nb2710

Netmodule Nb2800

Netmodule Nb2810

Netmodule Nb3700

Netmodule Nb3701

Netmodule Nb3710

Netmodule Nb3711

Netmodule Nb3720

Netmodule Nb3800

Netmodule Nb800

References · 5

• 🔥 http://seclists.org/fulldisclosure/2021/Aug/22 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-39289 · Security Note
• https://osv.dev/vulnerability/CVE-2021-39289 · Vendor Advisory
• https://netmodule.com · Vendor Advisory
• https://t.me/cibsecurity/27675 · Telegram Post