Sign-up

ID

VAR-202202-1180


CVE

CVE-2021-21968


TITLE

Sealevel Systems, Inc. SeaConnect 370W  Input verification vulnerability in

Trust: 0.8

sources: JVNDB: JVNDB-2022-004773

DESCRIPTION

A file write vulnerability exists in the OTA update task functionality of Sealevel Systems, Inc. SeaConnect 370W v1.3.34. A specially-crafted MQTT payload can lead to arbitrary file overwrite. An attacker can perform a man-in-the-middle attack to trigger this vulnerability. Sealevel Systems, Inc. SeaConnect 370W There is an input validation vulnerability in.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. Used to remotely monitor and control the status of the actual I/O process

Trust: 2.7

sources: NVD: CVE-2021-21968 // JVNDB: JVNDB-2022-004773 // CNVD: CNVD-2022-10699 // CNNVD: CNNVD-202202-099

IOT TAXONOMY

category:['IoT']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2022-10699

AFFECTED PRODUCTS

vendor:sealevelmodel:seaconnect 370wscope:eqversion:1.3.34

Trust: 1.0

vendor:sealevelmodel:seaconnect 370wscope:eqversion: -

Trust: 0.8

vendor:sealevelmodel:seaconnect 370wscope:eqversion:seaconnect 370w firmware 1.3.34

Trust: 0.8

vendor:sealevelmodel:systems seaconnect 370wscope:eqversion:v1.3.34

Trust: 0.6

sources: CNVD: CNVD-2022-10699 // JVNDB: JVNDB-2022-004773 // NVD: CVE-2021-21968

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2021-21968
value: HIGH

Trust: 1.0

talos-cna@cisco.com: CVE-2021-21968
value: HIGH

Trust: 1.0

NVD: CVE-2021-21968
value: HIGH

Trust: 0.8

CNVD: CNVD-2022-10699
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-202202-099
value: HIGH

Trust: 0.6

nvd@nist.gov: CVE-2021-21968
severity: MEDIUM
baseScore: 6.8
vectorString: AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.6
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

CNVD: CNVD-2022-10699
severity: MEDIUM
baseScore: 5.8
vectorString: AV:N/AC:M/AU:N/C:N/I:P/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.6
impactScore: 4.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

nvd@nist.gov: CVE-2021-21968
baseSeverity: HIGH
baseScore: 8.3
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.6
impactScore: 6.0
version: 3.1

Trust: 1.0

talos-cna@cisco.com: CVE-2021-21968
baseSeverity: HIGH
baseScore: 8.1
vectorString: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.2
impactScore: 5.9
version: 3.0

Trust: 1.0

NVD: CVE-2021-21968
baseSeverity: HIGH
baseScore: 8.3
vectorString: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: CNVD: CNVD-2022-10699 // JVNDB: JVNDB-2022-004773 // CNNVD: CNNVD-202202-099 // NVD: CVE-2021-21968 // NVD: CVE-2021-21968

PROBLEMTYPE DATA

problemtype:NVD-CWE-Other

Trust: 1.0

problemtype:CWE-20

Trust: 1.0

problemtype:Inappropriate input confirmation (CWE-20) [NVD evaluation ]

Trust: 0.8

sources: JVNDB: JVNDB-2022-004773 // NVD: CVE-2021-21968

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202202-099

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-202202-099

PATCH

title:Top Pageurl:https://www.sealevel.com/

Trust: 0.8

title:Patch for Sealevel Systems SeaConnect 370W File Write Vulnerabilityurl:https://www.cnvd.org.cn/patchInfo/show/319856

Trust: 0.6

title:Sealevel Systems SeaConnect 370W Enter the fix for the verification error vulnerabilityurl:http://123.124.177.30/web/xxk/bdxqById.tag?id=180570

Trust: 0.6

sources: CNVD: CNVD-2022-10699 // JVNDB: JVNDB-2022-004773 // CNNVD: CNNVD-202202-099

EXTERNAL IDS

db:NVDid:CVE-2021-21968

Trust: 3.8

db:TALOSid:TALOS-2021-1395

Trust: 3.0

db:JVNDBid:JVNDB-2022-004773

Trust: 0.8

db:CNVDid:CNVD-2022-10699

Trust: 0.6

db:CNNVDid:CNNVD-202202-099

Trust: 0.6

sources: CNVD: CNVD-2022-10699 // JVNDB: JVNDB-2022-004773 // CNNVD: CNNVD-202202-099 // NVD: CVE-2021-21968

REFERENCES

url:https://talosintelligence.com/vulnerability_reports/talos-2021-1395

Trust: 3.6

url:https://nvd.nist.gov/vuln/detail/cve-2021-21968

Trust: 1.4

sources: CNVD: CNVD-2022-10699 // JVNDB: JVNDB-2022-004773 // CNNVD: CNNVD-202202-099 // NVD: CVE-2021-21968

CREDITS

Discovered by Francesco Benvenuto and Matt Wiseman of Cisco Talos.

Trust: 0.6

sources: CNNVD: CNNVD-202202-099

SOURCES

db:CNVDid:CNVD-2022-10699
db:JVNDBid:JVNDB-2022-004773
db:CNNVDid:CNNVD-202202-099
db:NVDid:CVE-2021-21968

LAST UPDATE DATE

2024-08-14T14:02:45.766000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2022-10699date:2022-02-16T00:00:00
db:JVNDBid:JVNDB-2022-004773date:2023-05-01T08:23:00
db:CNNVDid:CNNVD-202202-099date:2023-07-03T00:00:00
db:NVDid:CVE-2021-21968date:2023-06-30T18:08:30.907

SOURCES RELEASE DATE

db:CNVDid:CNVD-2022-10699date:2022-02-16T00:00:00
db:JVNDBid:JVNDB-2022-004773date:2023-05-01T00:00:00
db:CNNVDid:CNNVD-202202-099date:2022-02-01T00:00:00
db:NVDid:CVE-2021-21968date:2022-02-04T23:15:10.717