CVE-2021-36767 Weak cryptography in n/a
An attacker can obtain a weakly-hashed server password via unauthenticated requests and crack it offline to gain unauthorized access to the Digi RealPort server.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-36767?
CVE-2021-36767 is a critical vulnerability in n/a, published on 8 Oct 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Digi RealPort through 4.10.490, authentication relies on a challenge-response mechanism that gives access to the server password, making the protection ineffective. An attacker may send an unauthenticated request to the server. The server will reply with a weakly-hashed version of the server's access password. The attacker may then crack this hash offline in order to successfully login to the server.
Weakness: CWE-916
Which versions are affected by CVE-2021-36767?
It affects 19 products.
Products include Digi 6350-Sr Firmware, Digi Cm Firmware, Digi Connect Es Firmware, Digi Connectport Lts 8\/16\/32 Firmware, Digi Connectport Ts 8\/16 Firmware, Digi One Ia Firmware and 13 more.
How do I fix CVE-2021-36767?
No fix has been published for CVE-2021-36767 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-36767 being exploited?
There is no known exploitation of CVE-2021-36767 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-22vf-qc4p-vc3x.