CVE-2021-20677 Denial of service in UNIVERGE Aspire series PBX
Remote authenticated attackers can cause a denial of service on NEC UNIVERGE PBX systems by sending specially crafted commands.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-20677?
CVE-2021-20677 is a low-severity denial of service vulnerability in NEC Platforms, Ltd. UNIVERGE Aspire series PBX, published on 26 Mar 2021. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
UNIVERGE Aspire series PBX (UNIVERGE Aspire WX from 1.00 to 3.51, UNIVERGE Aspire UX from 1.00 to 9.70, UNIVERGE SV9100 from 1.00 to 10.70, and SL2100 from 1.00 to 3.00) allows a remote authenticated attacker to cause system down and a denial of service (DoS) condition by sending a specially crafted command.
Which versions are affected by CVE-2021-20677?
It affects 4 products.
Products include Necplatforms Sl2100 Firmware, Necplatforms Univerge Aspire Ux Firmware, Necplatforms Univerge Aspire Wx Firmware, Necplatforms Univerge Sv9100 Firmware.
How do I fix CVE-2021-20677?
No fix has been published for CVE-2021-20677 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2021-20677 being exploited?
There is no known exploitation of CVE-2021-20677 in the wild and no public exploit code.
Sources
Also known as GHSA-xwf3-pcvx-xf5j.