CVE-2021-26637 — HIGH (8.8)

Vulnerability Description

There is no account authentication and permission check logic in the firmware and existing apps of SiHAS's SGW-300, ACM-300, GCM-300, so unauthorized users can remotely control the device.

CVSS Score

8.8

HIGH

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

ADJACENT_NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

HIGH

Affected Products

Vendor	Product	Versions
Shinasys	Sihas Sgw-300 Firmware	-
Shinasys	Sihas Sgw-300	-
Shinasys	Sihas Acm-300 Firmware	-
Shinasys	Sihas Acm-300	-
Shinasys	Sihas Gcm-300 Firmware	-
Shinasys	Sihas Gcm-300	-

Related Weaknesses (CWE)

CWE-306 CWE-287 CWE-862

References

https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=66782Broken LinkThird Party AdvisoryVDB Entry
https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=66782Broken LinkThird Party AdvisoryVDB Entry

FAQ

What is CVE-2021-26637?

CVE-2021-26637 is a vulnerability with a CVSS score of 8.8 (HIGH). There is no account authentication and permission check logic in the firmware and existing apps of SiHAS's SGW-300, ACM-300, GCM-300, so unauthorized users can remotely control the device.

How severe is CVE-2021-26637?

CVE-2021-26637 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2021-26637?

Check the references section above for vendor advisories and patch information. Affected products include: Shinasys Sihas Sgw-300 Firmware, Shinasys Sihas Sgw-300, Shinasys Sihas Acm-300 Firmware, Shinasys Sihas Acm-300, Shinasys Sihas Gcm-300 Firmware.