CVE-2020-21991

Katalog CVE

CVSS 9.8 · Critical EPSS 2,9%

Kerentanan Improper Authentication pada ave dominaplus, ave 53ab-wbs firmware +5 lainnya. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

AVE DOMINAplus <=1.10.x suffers from an authentication bypass vulnerability due to missing control check when directly calling the autologin GET parameter in changeparams.php script. Setting the autologin value to 1 allows an unauthenticated attacker to permanently disable the authentication security control and access the management interface with admin privileges without providing credentials.

Rincian

Terbit di NVD

28 April 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-287: Improper Authentication

EPSS (30 hari)

2,9% peluang dieksploitasi; lebih tinggi dari 86,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.exploit-db.com/exploits/47822 exploit · advisory pihak ketiga · vdb entry
• https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5549.php exploit · advisory pihak ketiga