Vulnerabilities (CVE)

Filtered by vendor Lannerinc Subscribe
Filtered by product Iac-ast2500a
Total 12 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2021-45925 1 Lannerinc 2 Iac-ast2500a, Iac-ast2500a Firmware 2023-12-10 N/A 5.3 MEDIUM
Observable discrepancies in the login process allow an attacker to guess legitimate user names registered in the BMC. This issue affects: Lanner Inc IAC-AST2500A standard firmware version 1.10.0.
CVE-2021-44467 1 Lannerinc 2 Iac-ast2500a, Iac-ast2500a Firmware 2023-12-10 N/A 7.5 HIGH
A broken access control vulnerability in the KillDupUsr_func function of spx_restservice allows an attacker to arbitrarily terminate active sessions of other users, causing a Denial-of-Service (DoS) condition. This issue affects: Lanner Inc IAC-AST2500A standard firmware version 1.10.0.
CVE-2021-26729 1 Lannerinc 2 Iac-ast2500a, Iac-ast2500a Firmware 2023-12-10 N/A 9.8 CRITICAL
Command injection and multiple stack-based buffer overflows vulnerabilities in the Login_handler_func function of spx_restservice allow an attacker to execute arbitrary code with the same privileges as the server user (root). This issue affects: Lanner Inc IAC-AST2500A standard firmware version 1.10.0.
CVE-2021-26732 1 Lannerinc 2 Iac-ast2500a, Iac-ast2500a Firmware 2023-12-10 N/A 5.3 MEDIUM
A broken access control vulnerability in the First_network_func function of spx_restservice allows an attacker to arbitrarily change the network configuration of the BMC. This issue affects: Lanner Inc IAC-AST2500A standard firmware version 1.10.0.
CVE-2021-26728 1 Lannerinc 2 Iac-ast2500a, Iac-ast2500a Firmware 2023-12-10 N/A 9.8 CRITICAL
Command injection and stack-based buffer overflow vulnerabilities in the KillDupUsr_func function of spx_restservice allow an attacker to execute arbitrary code with the same privileges as the server user (root). This issue affects: Lanner Inc IAC-AST2500A standard firmware version 1.10.0.
CVE-2021-44769 1 Lannerinc 2 Iac-ast2500a, Iac-ast2500a Firmware 2023-12-10 N/A 6.5 MEDIUM
An improper input validation vulnerability in the TLS certificate generation function allows an attacker to cause a Denial-of-Service (DoS) condition which can only be reverted via a factory reset. This issue affects: Lanner Inc IAC-AST2500A standard firmware version 1.10.0.
CVE-2021-26731 1 Lannerinc 2 Iac-ast2500a, Iac-ast2500a Firmware 2023-12-10 N/A 9.8 CRITICAL
Command injection and multiple stack-based buffer overflows vulnerabilities in the modifyUserb_func function of spx_restservice allow an attacker to execute arbitrary code with the same privileges as the server user (root). This issue affects: Lanner Inc IAC-AST2500A standard firmware version 1.10.0.
CVE-2021-46279 1 Lannerinc 2 Iac-ast2500a, Iac-ast2500a Firmware 2023-12-10 N/A 8.8 HIGH
Session fixation and insufficient session expiration vulnerabilities allow an attacker to perfom session hijacking attacks against users. This issue affects: Lanner Inc IAC-AST2500A standard firmware version 1.10.0.
CVE-2021-26730 1 Lannerinc 2 Iac-ast2500a, Iac-ast2500a Firmware 2023-12-10 N/A 9.8 CRITICAL
A stack-based buffer overflow vulnerability in a subfunction of the Login_handler_func function of spx_restservice allows an attacker to execute arbitrary code with the same privileges as the server user (root). This issue affects: Lanner Inc IAC-AST2500A standard firmware version 1.10.0.
CVE-2021-44776 1 Lannerinc 2 Iac-ast2500a, Iac-ast2500a Firmware 2023-12-10 N/A 5.3 MEDIUM
A broken access control vulnerability in the SubNet_handler_func function of spx_restservice allows an attacker to arbitrarily change the security access rights to KVM and Virtual Media functionalities. This issue affects: Lanner Inc IAC-AST2500A standard firmware version 1.10.0.
CVE-2021-26733 1 Lannerinc 2 Iac-ast2500a, Iac-ast2500a Firmware 2023-12-10 N/A 7.5 HIGH
A broken access control vulnerability in the FirstReset_handler_func function of spx_restservice allows an attacker to arbitrarily send reboot commands to the BMC, causing a Denial-of-Service (DoS) condition. This issue affects: Lanner Inc IAC-AST2500A standard firmware version 1.10.0.
CVE-2021-26727 1 Lannerinc 2 Iac-ast2500a, Iac-ast2500a Firmware 2023-12-10 N/A 9.8 CRITICAL
Multiple command injections and stack-based buffer overflows vulnerabilities in the SubNet_handler_func function of spx_restservice allow an attacker to execute arbitrary code with the same privileges as the server user (root). This issue affects: Lanner Inc IAC-AST2500A standard firmware version 1.10.0.