CVE-2021-26637

Description

There is no account authentication and permission check logic in the firmware and existing apps of SiHAS's SGW-300, ACM-300, GCM-300, so unauthorized users can remotely control the device.

Related CPE's

oshinasyssihas_sgw-300_firmware-****iphone_os**

oshinasyssihas_sgw-300_firmware-****android**

hshinasyssihas_sgw-300-*******

oshinasyssihas_acm-300_firmware-****iphone_os**

oshinasyssihas_acm-300_firmware-****android**

hshinasyssihas_acm-300-*******

oshinasyssihas_gcm-300_firmware-****iphone_os**

oshinasyssihas_gcm-300_firmware-****android**

hshinasyssihas_gcm-300-*******

References

https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=66782

Third Party AdvisoryVDB Entry

CvssV3 impact

Could not find any metrics

CvssV2 impact

AccessComplexity

LOW

ConfidentialityImpact

PARTIAL

AvailabilityImpact

PARTIAL

IntegrityImpact

PARTIAL

BaseScore

7.5

VectorString

AV:N/AC:L/Au:N/C:P/I:P/A:P

Version

2.0

AccessVector

NETWORK

Authentication

NONE

Created by Yello
About Severity.io