CVE-2021-22909
7.5
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Exploitability: 1.6 / Impact: 5.9
Source: NVD
Description
A vulnerability found in EdgeMAX EdgeRouter V2.0.9 and earlier could allow a malicious actor to execute a man-in-the-middle (MitM) attack during a firmware update. This vulnerability is fixed in EdgeMAX EdgeRouter V2.0.9-hotfix.1 and later.
Affected (1)
Products: Ui: Edgemax Edgerouter Firmware
Configuration A
| Vulnerable Software | Affected Versions |
|---|---|
| Up to 2.0.9 |
| Running on/with | Platform Versions |
|---|---|
Ui Edgemax Edgerouter | All versions |
Related CWEs
CWE-295
Improper Certificate Validation
The product does not validate, or incorrectly validates, a certificate.
CWE-300
Channel Accessible by Non-Endpoint
The product does not adequately verify the identity of actors at both ends of a communication channel, or does not adequately ensure the integrity of the channel, in a way that allows the channel to be accessed or influenced by an actor that is not an endpoint.
References (2)
Source: support@hackerone.com
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
Timeline
No history available yet.