CVE-2021-46279 - Vulnerability Details - OpenCVE

Session fixation and insufficient session expiration vulnerabilities allow an attacker to perfom session hijacking attacks against users. This issue affects: Lanner Inc IAC-AST2500A standard firmware version 1.10.0.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Lannerinc	Iac-ast2500a Iac-ast2500a Firmware

Configuration 1 [-]

AND

cpe:2.3:o:lannerinc:iac-ast2500a_firmware:1.10.0:*:*:*:*:*:*:*

cpe:2.3:h:lannerinc:iac-ast2500a:-:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://www.nozominetworks.com/blog/vulnerabilities-in-bmc-firmware-affect-ot-iot-device-security-part-1/
https://www.nozominetworks.com/labs/vulnerability-advisories/cve-2021-46279/

History

Wed, 07 May 2025 14:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: Nozomi

Published: 2022-10-24T00:00:00.000Z

Updated: 2025-05-07T13:43:25.886Z

Reserved: 2022-05-13T00:00:00.000Z

Link: CVE-2021-46279

Vulnrichment

Updated: 2024-08-04T05:02:11.401Z

NVD

Status : Modified

Published: 2022-10-24T14:15:49.903

Modified: 2024-11-21T06:33:50.620

Link: CVE-2021-46279

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2021-46279", "assignerOrgId": "bec8025f-a851-46e5-b3a3-058e6b0aa23c", "assignerShortName": "Nozomi", "dateUpdated": "2025-05-07T13:43:25.886Z", "dateReserved": "2022-05-13T00:00:00.000Z", "datePublished": "2022-10-24T00:00:00.000Z"}, "containers": {"cna": {"title": "Session Fixation and Insufficient Session Expiration", "providerMetadata": {"orgId": "bec8025f-a851-46e5-b3a3-058e6b0aa23c", "shortName": "Nozomi", "dateUpdated": "2022-12-01T00:00:00.000Z"}, "descriptions": [{"lang": "en", "value": "Session fixation and insufficient session expiration vulnerabilities allow an attacker to perfom session hijacking attacks against users. This issue affects: Lanner Inc IAC-AST2500A standard firmware version 1.10.0."}], "affected": [{"vendor": "Lanner Inc", "product": "IAC-AST2500A", "versions": [{"version": "1.10.0", "status": "affected"}]}], "references": [{"url": "https://www.nozominetworks.com/blog/vulnerabilities-in-bmc-firmware-affect-ot-iot-device-security-part-1/"}, {"url": "https://www.nozominetworks.com/labs/vulnerability-advisories/cve-2021-46279/"}], "credits": [{"lang": "en", "value": "Andrea Palanca of Nozomi Networks found this bug during a security research activity."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "LOW", "baseScore": 5.8, "baseSeverity": "MEDIUM"}}], "problemTypes": [{"descriptions": [{"type": "CWE", "lang": "en", "description": "CWE-384 Session Fixation", "cweId": "CWE-384"}]}, {"descriptions": [{"type": "CWE", "lang": "en", "description": "CWE-613 Insufficient Session Expiration", "cweId": "CWE-613"}]}], "x_generator": {"engine": "Vulnogram 0.0.9"}, "source": {"advisory": "https://www.nozominetworks.com/labs/vulnerability-advisories/cve-2021-46279/", "discovery": "EXTERNAL"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T05:02:11.401Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.nozominetworks.com/blog/vulnerabilities-in-bmc-firmware-affect-ot-iot-device-security-part-1/", "tags": ["x_transferred"]}, {"url": "https://www.nozominetworks.com/labs/vulnerability-advisories/cve-2021-46279/", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-05-07T13:40:03.764652Z", "id": "CVE-2021-46279", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-07T13:43:25.886Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2021-46279", "assignerOrgId": "bec8025f-a851-46e5-b3a3-058e6b0aa23c", "assignerShortName": "Nozomi", "dateUpdated": "2025-05-07T13:43:25.886Z", "dateReserved": "2022-05-13T00:00:00.000Z", "datePublished": "2022-10-24T00:00:00.000Z"}, "containers": {"cna": {"title": "Session Fixation and Insufficient Session Expiration", "providerMetadata": {"orgId": "bec8025f-a851-46e5-b3a3-058e6b0aa23c", "shortName": "Nozomi", "dateUpdated": "2022-12-01T00:00:00.000Z"}, "descriptions": [{"lang": "en", "value": "Session fixation and insufficient session expiration vulnerabilities allow an attacker to perfom session hijacking attacks against users. This issue affects: Lanner Inc IAC-AST2500A standard firmware version 1.10.0."}], "affected": [{"vendor": "Lanner Inc", "product": "IAC-AST2500A", "versions": [{"version": "1.10.0", "status": "affected"}]}], "references": [{"url": "https://www.nozominetworks.com/blog/vulnerabilities-in-bmc-firmware-affect-ot-iot-device-security-part-1/"}, {"url": "https://www.nozominetworks.com/labs/vulnerability-advisories/cve-2021-46279/"}], "credits": [{"lang": "en", "value": "Andrea Palanca of Nozomi Networks found this bug during a security research activity."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "LOW", "baseScore": 5.8, "baseSeverity": "MEDIUM"}}], "problemTypes": [{"descriptions": [{"type": "CWE", "lang": "en", "description": "CWE-384 Session Fixation", "cweId": "CWE-384"}]}, {"descriptions": [{"type": "CWE", "lang": "en", "description": "CWE-613 Insufficient Session Expiration", "cweId": "CWE-613"}]}], "x_generator": {"engine": "Vulnogram 0.0.9"}, "source": {"advisory": "https://www.nozominetworks.com/labs/vulnerability-advisories/cve-2021-46279/", "discovery": "EXTERNAL"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T05:02:11.401Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.nozominetworks.com/blog/vulnerabilities-in-bmc-firmware-affect-ot-iot-device-security-part-1/", "tags": ["x_transferred"]}, {"url": "https://www.nozominetworks.com/labs/vulnerability-advisories/cve-2021-46279/", "tags": ["x_transferred"]}]}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2021-46279", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-05-07T13:40:03.764652Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-07T13:43:06.246Z"}}]}}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:lannerinc:iac-ast2500a_firmware:1.10.0:*:*:*:*:*:*:*", "matchCriteriaId": "8DD71184-078B-4B7E-BCB5-11E55B5928B7", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:lannerinc:iac-ast2500a:-:*:*:*:*:*:*:*", "matchCriteriaId": "9007683B-45DA-471A-9CCB-A587DED8D973", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "Session fixation and insufficient session expiration vulnerabilities allow an attacker to perfom session hijacking attacks against users. This issue affects: Lanner Inc IAC-AST2500A standard firmware version 1.10.0."}, {"lang": "es", "value": "unas vulnerabilidades de fijaci\u00f3n de sesi\u00f3n y caducidad de sesi\u00f3n insuficiente permiten a un atacante realizar ataques de secuestro de sesi\u00f3n contra usuarios. Este problema afecta: Lanner Inc IAC-AST2500A versi\u00f3n de firmware est\u00e1ndar 1.10.0"}], "id": "CVE-2021-46279", "lastModified": "2024-11-21T06:33:50.620", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 3.7, "source": "prodsec@nozominetworks.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-10-24T14:15:49.903", "references": [{"source": "prodsec@nozominetworks.com", "tags": ["Third Party Advisory"], "url": "https://www.nozominetworks.com/blog/vulnerabilities-in-bmc-firmware-affect-ot-iot-device-security-part-1/"}, {"source": "prodsec@nozominetworks.com", "tags": ["Third Party Advisory"], "url": "https://www.nozominetworks.com/labs/vulnerability-advisories/cve-2021-46279/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://www.nozominetworks.com/blog/vulnerabilities-in-bmc-firmware-affect-ot-iot-device-security-part-1/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://www.nozominetworks.com/labs/vulnerability-advisories/cve-2021-46279/"}], "sourceIdentifier": "prodsec@nozominetworks.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-384"}, {"lang": "en", "value": "CWE-613"}], "source": "prodsec@nozominetworks.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-384"}, {"lang": "en", "value": "CWE-613"}], "source": "nvd@nist.gov", "type": "Primary"}]}