CVE-2021-33903

Q: What is the severity of CVE-2021-33903?

CVE-2021-33903 is considered a medium severity vulnerability affecting LANCOM devices.

Q: How do I fix CVE-2021-33903?

To mitigate CVE-2021-33903, ensure that the root user password is changed via LANconfig instead of the CLI.

Q: Which devices are affected by CVE-2021-33903?

CVE-2021-33903 affects LANCOM devices running LCOS versions 10.40 through 10.42.0473 with SNMPv3 enabled.

Q: What does CVE-2021-33903 affect in LANCOM devices?

CVE-2021-33903 affects the root user password synchronization between CLI and SNMPv3 access in LANCOM devices.

Q: Is remote exploitation possible with CVE-2021-33903?

Yes, remote exploitation is possible with CVE-2021-33903 due to the SNMPv3 protocol weaknesses.

Published Oct 7, 2021

Updated

In LCOS 10.40 to 10.42.0473-RU3 with SNMPv3 enabled on LANCOM devices, changing the password of the root user via the CLI does not change the password of the root user for SNMPv3 access. (However, changing the password of the root user via LANconfig does change the password of the root user for SNMPv3 access.)

Affected Software

5 affected components

Lancom-systems Lcos>=10.40<10.42.0473

Lancom-systems Lcos=10.42.0473

Lancom-systems Lcos=10.42.0473-release_update1

Lancom-systems Lcos=10.42.0473-release_update2

Lancom-systems Lcos=10.42.0473-release_update3

Event History

Oct 7, 2021

CVE Published

via MITRE·02:48 PM

Data Sourced

via MITRE·02:48 PM

Description

Frequently Asked Questions

What is the severity of CVE-2021-33903?

CVE-2021-33903 is considered a medium severity vulnerability affecting LANCOM devices.

How do I fix CVE-2021-33903?

To mitigate CVE-2021-33903, ensure that the root user password is changed via LANconfig instead of the CLI.

Which devices are affected by CVE-2021-33903?

CVE-2021-33903 affects LANCOM devices running LCOS versions 10.40 through 10.42.0473 with SNMPv3 enabled.

What does CVE-2021-33903 affect in LANCOM devices?

CVE-2021-33903 affects the root user password synchronization between CLI and SNMPv3 access in LANCOM devices.

Is remote exploitation possible with CVE-2021-33903?

Yes, remote exploitation is possible with CVE-2021-33903 due to the SNMPv3 protocol weaknesses.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.