CVE-2021-22661 Auth bypass in ICX35-HWC-A, ICX35-HWC-E
Attackers can change the administrator password without knowing the current one, leading to unauthorized access on ICX35 controllers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-22661?
CVE-2021-22661 is a high-severity authentication bypass vulnerability in ICX35-HWC-A, ICX35-HWC-E, published on 26 Feb 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Changing the password on the module webpage does not require the user to type in the current password first. Thus, the password could be changed by a user or external process without knowledge of the current password on the ICX35-HWC-A and ICX35-HWC-E (Versions 1.9.62 and prior).
Weakness: CWE-264
Which versions are affected by CVE-2021-22661?
It affects 2 products.
Products include Prosoft-Technology Icx35-Hwc-a Firmware, Prosoft-Technology Icx35-Hwc-E Firmware.
How do I fix CVE-2021-22661?
No fix has been published for CVE-2021-22661 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2021-22661 being exploited?
There is no known exploitation of CVE-2021-22661 in the wild and no public exploit code.
Sources
Also known as GHSA-cm5g-7gvh-66wv.