PT-2021-7318 · Unknown · Networking Os10

James Hebden · Published 2021-11-19 · Updated 2021-11-23 · CVE-2021-36307

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Networking OS10 versions prior to October 2021

Description The issue is related to a privilege escalation vulnerability in the implementation of the RESTCONF API in the Networking OS10. A malicious low-privileged user with specific access to the API could potentially exploit this vulnerability to gain admin privileges on the affected system. The vulnerability is associated with errors in privilege management.

Recommendations For versions prior to October 2021, consider disabling the RESTCONF API until a patch is available to prevent potential exploitation. Restrict access to the API to minimize the risk of privilege escalation. As a temporary workaround, limit the privileges of low-privileged users to reduce the impact of a potential exploit.

Fix

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

BDU:2022-05672

CVE-2021-36307

Affected Products

Networking Os10

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2021-36307 · Security Note
• https://osv.dev/vulnerability/CVE-2021-36307 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-05672 · Security Note
• https://dell.com/support/kbdoc/en-us/000193076 · Vendor Advisory
• https://t.me/cvenotify/23545 · Telegram Post
• https://t.me/cibsecurity/32756 · Telegram Post
• https://t.me/cvenotify/23534 · Telegram Post
• https://vuldb.com/ru/?id.187064 · Note