CVE-2021-32002 SiteManager troubleshooter allows access without authentication from local network
Local attackers can access Secomea SiteManager web services without credentials to view network configuration and information.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-32002?
CVE-2021-32002 is a medium-severity missing authorization vulnerability in Secomea SiteManager, published on 5 Aug 2021. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Improper Access Control vulnerability in web service of Secomea SiteManager allows local attacker without credentials to gather network information and configuration of the SiteManager. This issue affects: Secomea SiteManager All versions prior to 9.5 on Hardware.
Which versions are affected by CVE-2021-32002?
It affects 1 product.
Products include Secomea Sitemanager Firmware.
How do I fix CVE-2021-32002?
No fix has been published for CVE-2021-32002 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2021-32002 being exploited?
There is no known exploitation of CVE-2021-32002 in the wild and no public exploit code.
Other vulnerabilities in Secomea SiteManager
Sources
Also known as GHSA-g48h-ph99-79xp.