image credit: pxfuel
A total of five vulnerabilities were identified, the most severe of which carries a CVSS score of 9.7 and is tracked as CVE-2021-33885. The issue exists because the device doesn’t verify who is sending the commands, thus allowing a remote, unauthenticated attacker to send input to the device, which will use it instead of the correct data.
Next in line is CVE-2021-33886 (CVSS score of 8.2), where proprietary networking commands aren’t properly authenticated, thus allowing an attacker to reconfigure the device remotely.
Comments are closed.
