Advisories · Technology

Lanner Inc IAC-AST2500A.

Every CVE that names Lanner Inc IAC-AST2500A among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2021-46279 CVE record

CVSS 5.8 Medium

Session Fixation and Insufficient Session Expiration
- Lanner Inc IAC-AST2500A
- Authentication bypass
Not analysed yet 24 Oct 2022
CVE-2021-45925 CVE record

CVSS 5.3 Medium

Username Enumeration
- Lanner Inc IAC-AST2500A
- Information disclosure
Not analysed yet 24 Oct 2022
CVE-2021-44776 CVE record

CVSS 6.5 Medium

spx_restservice SubNet_handler_func Broken Access Control
- Lanner Inc IAC-AST2500A
- Broken access control
Not analysed yet 24 Oct 2022
CVE-2021-44769 CVE record

CVSS 4.9 Medium

TLS Certificate Generation Function Improper Input Validation
- Lanner Inc IAC-AST2500A
- CWE-20
Not analysed yet 24 Oct 2022
CVE-2021-44467 CVE record

CVSS 5.3 Medium

spx_restservice KillDupUsr_func Broken Access Control
- Lanner Inc IAC-AST2500A
- Broken access control
Not analysed yet 24 Oct 2022
CVE-2021-4228 CVE record

CVSS 5.8 Medium

Hard-coded TLS Certificate
- Lanner Inc IAC-AST2500A
- Hard-coded credentials
Not analysed yet 24 Oct 2022
CVE-2021-26733 CVE record

CVSS 5.3 Medium

spx_restservice FirstReset_handler_func Broken Access Control
- Lanner Inc IAC-AST2500A
- Broken access control
Not analysed yet 24 Oct 2022
CVE-2021-26732 CVE record

CVSS 6.5 Medium

spx_restservice First_network_func Broken Access Control
- Lanner Inc IAC-AST2500A
- Broken access control
Not analysed yet 24 Oct 2022
CVE-2021-26731 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

spx_restservice modifyUserb_func Command Injection and Multiple Stack-Based Buffer Overflows
- Lanner Inc IAC-AST2500A
- Code injection
- Memory corruption
Not analysed yet 24 Oct 2022
CVE-2021-26730 CVE record

CVSS 10.0 CriticalCritical · CVSS 9+

spx_restservice Login_handler_func Subfunction Stack-Based Buffer Overflow
- Lanner Inc IAC-AST2500A
- Memory corruption
Not analysed yet 24 Oct 2022
CVE-2021-26729 CVE record

CVSS 10.0 CriticalCritical · CVSS 9+

spx_restservice Login_handler_func Command Injection and Multiple Stack-Based Buffer Overflows
- Lanner Inc IAC-AST2500A
- Code injection
- Memory corruption
Not analysed yet 24 Oct 2022
CVE-2021-26728 CVE record

CVSS 10.0 CriticalCritical · CVSS 9+

spx_restservice KillDupUsr_func Command Injection and Stack-Based Buffer Overflow
- Lanner Inc IAC-AST2500A
- Code injection
- Memory corruption
Not analysed yet 24 Oct 2022
CVE-2021-26727 CVE record

CVSS 10.0 CriticalCritical · CVSS 9+

spx_restservice SubNet_handler_func Multiple Command Injections and Stack-Based Buffer Overflows
- Lanner Inc IAC-AST2500A
- Code injection
- Memory corruption
Not analysed yet 24 Oct 2022