CVE-2021-35336 Missing authorization in n/a
Unauthenticated attackers can access sensitive high-privileged areas of the Tieline IP Audio Gateway web interface due to incorrect access control.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-35336?
CVE-2021-35336 is a critical missing authorization vulnerability in n/a, published on 1 Jul 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Tieline IP Audio Gateway 2.6.4.8 and below is affected by Incorrect Access Control. A vulnerability in the Tieline Web Administrative Interface could allow an unauthenticated user to access a sensitive part of the system with a high privileged account.
Weakness: CWE-1188
Which versions are affected by CVE-2021-35336?
It affects 1 product.
Products include Tieline Ip Audtio Gateway Firmware.
How do I fix CVE-2021-35336?
No fix has been published for CVE-2021-35336 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2021-35336 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2021-35336 exists.
Public exploit code: 1 Nuclei template.
Sources
Also known as GHSA-gcr2-226m-p44h.