CVE-2021-27437
Quick assessment
Affected
n/a WISE-PaaS/RMM
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Advantech WISE-PaaS/RMM是中国台湾研华（Advantech）公司的一套物联网设备远程监控管理平台。该平台支持基于云的集中式远程IPC、IoT设备硬件和软件状态监视和管理，支持远程电源开/关和调度、数据采集与存储等功能。 WISE-PaaS/RMM 9.0.1之前版本存在信任管理问题漏洞，该漏洞源于dashboard存在硬编码凭证。未经身份验证的远程攻击者可利用该漏洞可以使用硬编码的凭据访问受影响的系统。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2021-27437
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
The affected product allows attackers to obtain sensitive information from the WISE-PaaS dashboard. The system contains a hard-coded administrator username and password that can be used to query Grafana APIs. Authentication is not required for exploitation on the WISE-PaaS/RMM (versions prior to 9.0.1).
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
使用硬编码的凭证
Source: CVE Program / CVE List V5
Vulnerability Title
Advantech WISE-PaaS/RMM 信任管理问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Advantech WISE-PaaS/RMM是中国台湾研华（Advantech）公司的一套物联网设备远程监控管理平台。该平台支持基于云的集中式远程IPC、IoT设备硬件和软件状态监视和管理，支持远程电源开/关和调度、数据采集与存储等功能。 WISE-PaaS/RMM 9.0.1之前版本存在信任管理问题漏洞，该漏洞源于dashboard存在硬编码凭证。未经身份验证的远程攻击者可利用该漏洞可以使用硬编码的凭据访问受影响的系统。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| - | WISE-PaaS/RMM | versions prior to 9.0.1 | - |
|
II. Public POCs for CVE-2021-27437
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2021-27437
请登录查看更多情报信息。
Vendor Advisories for CVE-2021-27437 (1)
-
https://us-cert.cisa.gov/ics/advisories/icsa-21-124-01 x_refsource_MISC
Same Patch Batch · n/a · 2021-05-07 · 42 CVEs total
| CVE-2021-27570 | Emote Remote Mouse 访问控制错误漏洞 | |
| CVE-2021-26123 | LivingLogic XIST4C 跨站脚本漏洞 | |
| CVE-2021-21984 | VMware vRealize Business for Cloud 命令注入漏洞 | |
| CVE-2020-14009 | Proofpoint Enterprise Protection 安全漏洞 | |
| CVE-2021-3502 | avahi 安全漏洞 | |
| CVE-2021-22675 | Texas Instruments SimpleLink 输入验证错误漏洞 | |
| CVE-2021-22679 | Texas Instruments SimpleLink 输入验证错误漏洞 | |
| CVE-2021-22671 | Texas Instruments SimpleLink 输入验证错误漏洞 | |
| CVE-2021-22673 | Texas Instruments SimpleLink 缓冲区错误漏洞 | |
| CVE-2021-22677 | Texas Instruments SimpleLink 输入验证错误漏洞 | |
| CVE-2021-27569 | Emote Remote Mouse 安全漏洞 | |
| CVE-2021-26122 | LivingLogic XIST4C 跨站脚本漏洞 | |
| CVE-2021-27571 | Emote Remote Mouse 访问控制错误漏洞 | |
| CVE-2021-27572 | Emote Remote Mouse 安全漏洞 | |
| CVE-2021-27573 | Emote Remote Mouse 安全漏洞 | |
| CVE-2021-27574 | Emote Remote Mouse 安全漏洞 | |
| CVE-2021-32470 | Pixel＆Tonic Craft CMS 跨站脚本漏洞 | |
| CVE-2021-31756 | Tenda AC11 缓冲区错误漏洞 | |
| CVE-2021-31758 | Tenda AC11 缓冲区错误漏洞 | |
| CVE-2021-31755 | Tenda AC11 缓冲区错误漏洞 |
Showing top 20 of 42 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
V. Comments for CVE-2021-27437
No comments yet