CVE-2021-33903 Auth bypass in n/a
Attackers can retain SNMPv3 root access after CLI password changes, bypassing authentication updates on LANCOM devices.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-33903?
CVE-2021-33903 is a high-severity authentication bypass vulnerability in n/a, published on 7 Oct 2021. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
In LCOS 10.40 to 10.42.0473-RU3 with SNMPv3 enabled on LANCOM devices, changing the password of the root user via the CLI does not change the password of the root user for SNMPv3 access. (However, changing the password of the root user via LANconfig does change the password of the root user for SNMPv3 access.)
Which versions are affected by CVE-2021-33903?
It affects 1 product.
Products include Lancom-Systems Lcos.
How do I fix CVE-2021-33903?
No fix has been published for CVE-2021-33903 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2021-33903 being exploited?
There is no known exploitation of CVE-2021-33903 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-h7w5-g7jm-642w.