CVE-2021-34543 Missing authorization in n/a
Remote attackers can gain administrative privileges and modify system configurations due to missing authentication in the web administration server.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-34543?
CVE-2021-34543 is a high-severity missing authorization vulnerability in n/a, published on 7 Dec 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The web administration server in Solar-Log 500 before 2.8.2 Build 52 does not require authentication, which allows remote attackers to gain administrative privileges by connecting to the server. As a result, the attacker can modify configuration files and change the system status. Fixed with 3.0.0-60 11.10.2013 for SL 200, 500, 1000 / not existing for SL 250, 300, 1200, 2000, SL 50 Gateway, SL Base.
Weakness: CWE-306
Which versions are affected by CVE-2021-34543?
It affects 1 product.
Products include Bkw Solar-Log 500 Firmware.
How do I fix CVE-2021-34543?
No fix has been published for CVE-2021-34543 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2021-34543 being exploited?
There is no known exploitation of CVE-2021-34543 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-fc22-jfw7-2qhg.