CVE-2021-36797

In Victron Energy Venus OS through 2.72, root access is granted by default to anyone with physical access to the device. NOTE: the vendor disagrees with the reporter's opinion about an alleged "security best practices" violation

CVSS v3 6.8 MEDIUM
CVSS v2.0 7.2 HIGH

6.8^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.9 / Impact : 5.9

Attack Vector PHYSICAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.2^/10

CVSS v2.0 : HIGH

Vector : AV:L/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 3.9 / Impact : 10.0

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
https://github.com/victronenergy/venus/issues/836	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:o:victronenergy:venus_os:*:*:*:*:*:*:*:*

History

07 Nov 2023, 03:36

Type	Values Removed	Values Added
Summary	DISPUTED In Victron Energy Venus OS through 2.72, root access is granted by default to anyone with physical access to the device. NOTE: the vendor disagrees with the reporter's opinion about an alleged "security best practices" violation.	In Victron Energy Venus OS through 2.72, root access is granted by default to anyone with physical access to the device. NOTE: the vendor disagrees with the reporter's opinion about an alleged "security best practices" violation

Information

Published : 2021-07-19 17:15

Updated : 2024-08-04 01:15

NVD link : CVE-2021-36797

Mitre link : CVE-2021-36797

CVE.ORG link : CVE-2021-36797

JSON object : View

Products Affected

victronenergy

venus_os

CWE

NVD-CWE-noinfo

{"id": "CVE-2021-36797", "cveTags": [{"tags": ["disputed"], "sourceIdentifier": "cve@mitre.org"}], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.2, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "PHYSICAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 0.9}]}, "published": "2021-07-19T17:15:11.870", "references": [{"url": "https://github.com/victronenergy/venus/issues/836", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "In Victron Energy Venus OS through 2.72, root access is granted by default to anyone with physical access to the device. NOTE: the vendor disagrees with the reporter's opinion about an alleged \"security best practices\" violation"}, {"lang": "es", "value": "** EN DISPUTA ** En Victron Energy Venus OS versiones hasta 2.72, el acceso root es concedido por defecto a cualquier persona con acceso f\u00edsico al dispositivo. NOTA: el proveedor no est\u00e1 de acuerdo con la opini\u00f3n del reportero sobre una supuesta violaci\u00f3n de \"security best practices\""}], "lastModified": "2024-08-04T01:15:48.210", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:victronenergy:venus_os:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B77EEF0E-57D1-4C91-86DE-91D94D666C71", "versionEndIncluding": "2.72"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}