CVE-2021-37123 Auth bypass in Hero-CT060
Improper authentication in Hero-CT060 allows attackers to perform unauthorized operations by bypassing identity validation checks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-37123?
CVE-2021-37123 is a critical authentication bypass vulnerability in Hero-CT060, published on 11 Oct 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
There is an improper authentication vulnerability in Hero-CT060 before 1.0.0.200. The vulnerability is due to that when an user wants to do certain operation, the software does not insufficiently validate the user's identity. Successful exploit could allow the attacker to do certain operations which the user are supposed not to do.
Weakness: CWE-287
Which versions are affected by CVE-2021-37123?
It affects 1 product.
Products include Huawei Hero-Ct060 Firmware.
How do I fix CVE-2021-37123?
No fix has been published for CVE-2021-37123 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2021-37123 being exploited?
There is no known exploitation of CVE-2021-37123 in the wild and no public exploit code.
Sources
Also known as GHSA-6p74-hfr6-rgm3.