PT-2022-12229 · Lanner · Lanner Inc Iac-Ast2500A

Andrea Palanca · Published 2022-10-24 · Updated 2023-02-03 · CVE-2021-44776

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions Lanner Inc IAC-AST2500A standard firmware version 1.10.0

Description A broken access control issue in the SubNet handler func function of spx restservice allows an attacker to change security access rights to KVM and Virtual Media functionalities.

Recommendations For Lanner Inc IAC-AST2500A standard firmware version 1.10.0, consider restricting access to the SubNet handler func function in spx restservice until a patch is available.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2021-44776

Affected Products

Lanner Inc Iac-Ast2500A

References · 5

• https://osv.dev/vulnerability/CVE-2021-44776 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-44776 · Security Note
• https://t.me/cibsecurity/51974 · Telegram Post
• https://nozominetworks.com/labs/vulnerability-advisories/cve-2021-44776 · Note
• https://nozominetworks.com/blog/vulnerabilities-in-bmc-firmware-affect-ot-iot-device-security-part-1 · Note