CVE-2021-45916

The programming function of Shockwall system has an improper input validation vulnerability. An authenticated attacker within the local area network can send malicious response to the server to disrupt the service partially.

CVSS v3 3.5 LOW
CVSS v2.0 2.7 LOW

3.5^/10

CVSS v3 : LOW

Vector :

Exploitability : 2.1 / Impact : 1.4

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

2.7^/10

CVSS v2.0 : LOW

Vector : AV:A/AC:L/Au:S/C:N/I:N/A:P

Exploitability : 5.1 / Impact : 2.9

Access Vector ADJACENT_NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact PARTIAL

References

Link	Resource
https://www.twcert.org.tw/tw/cp-132-5432-b9074-1.html	Third Party Advisory
https://www.twcert.org.tw/tw/cp-132-5432-b9074-1.html	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:smr:shenwang_endpoint_protection_security_system:*:*:*:*:*:*:*:*

History

21 Nov 2024, 06:33

Type	Values Removed	Values Added
References	~~() https://www.twcert.org.tw/tw/cp-132-5432-b9074-1.html - Third Party Advisory~~	() https://www.twcert.org.tw/tw/cp-132-5432-b9074-1.html - Third Party Advisory

Information

Published : 2022-01-03 10:15

Updated : 2024-11-21 06:33

NVD link : CVE-2021-45916

Mitre link : CVE-2021-45916

CVE.ORG link : CVE-2021-45916

JSON object : View

Products Affected

smr

shenwang_endpoint_protection_security_system

CWE

CWE-20

Improper Input Validation

{"id": "CVE-2021-45916", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 2.7, "accessVector": "ADJACENT_NETWORK", "vectorString": "AV:A/AC:L/Au:S/C:N/I:N/A:P", "authentication": "SINGLE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 5.1, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Secondary", "source": "twcert@cert.org.tw", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.5, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.1}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.5, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.1}]}, "published": "2022-01-03T10:15:08.327", "references": [{"url": "https://www.twcert.org.tw/tw/cp-132-5432-b9074-1.html", "tags": ["Third Party Advisory"], "source": "twcert@cert.org.tw"}, {"url": "https://www.twcert.org.tw/tw/cp-132-5432-b9074-1.html", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "twcert@cert.org.tw", "description": [{"lang": "en", "value": "CWE-20"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "The programming function of Shockwall system has an improper input validation vulnerability. An authenticated attacker within the local area network can send malicious response to the server to disrupt the service partially."}, {"lang": "es", "value": "La funci\u00f3n programming de Shockwall system presenta una vulnerabilidad de comprobaci\u00f3n de entrada inapropiada. Un atacante autenticado dentro de la red de \u00e1rea local puede enviar una respuesta maliciosa al servidor para interrumpir el servicio parcialmente"}], "lastModified": "2024-11-21T06:33:16.160", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:smr:shenwang_endpoint_protection_security_system:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3E7779B7-5127-44AC-AAAC-E0449236439B", "versionEndExcluding": "7.20.0401"}], "operator": "OR"}]}], "sourceIdentifier": "twcert@cert.org.tw"}