CVE-2021-20677 (GCVE-0-2021-20677)
Vulnerability from cvelistv5 – Published: 2021-03-26 08:50 – Updated: 2024-08-03 17:45
VLAI?
Summary
UNIVERGE Aspire series PBX (UNIVERGE Aspire WX from 1.00 to 3.51, UNIVERGE Aspire UX from 1.00 to 9.70, UNIVERGE SV9100 from 1.00 to 10.70, and SL2100 from 1.00 to 3.00) allows a remote authenticated attacker to cause system down and a denial of service (DoS) condition by sending a specially crafted command.
Severity ?
No CVSS data available.
CWE
- Denial-of-service (DoS)
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| NEC Platforms, Ltd. | UNIVERGE Aspire series PBX |
Affected:
UNIVERGE Aspire WX from 1.00 to 3.51, UNIVERGE Aspire UX from 1.00 to 9.70, UNIVERGE SV9100 from 1.00 to 10.70, and SL2100 from 1.00 to 3.00
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T17:45:45.461Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.necplatforms.co.jp/en/press/security_adv.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://jvn.jp/en/jp/JVN12737530/index.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "UNIVERGE Aspire series PBX",
"vendor": "NEC Platforms, Ltd.",
"versions": [
{
"status": "affected",
"version": "UNIVERGE Aspire WX from 1.00 to 3.51, UNIVERGE Aspire UX from 1.00 to 9.70, UNIVERGE SV9100 from 1.00 to 10.70, and SL2100 from 1.00 to 3.00"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "UNIVERGE Aspire series PBX (UNIVERGE Aspire WX from 1.00 to 3.51, UNIVERGE Aspire UX from 1.00 to 9.70, UNIVERGE SV9100 from 1.00 to 10.70, and SL2100 from 1.00 to 3.00) allows a remote authenticated attacker to cause system down and a denial of service (DoS) condition by sending a specially crafted command."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Denial-of-service (DoS)",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-03-26T08:50:26",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.necplatforms.co.jp/en/press/security_adv.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://jvn.jp/en/jp/JVN12737530/index.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "vultures@jpcert.or.jp",
"ID": "CVE-2021-20677",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "UNIVERGE Aspire series PBX",
"version": {
"version_data": [
{
"version_value": "UNIVERGE Aspire WX from 1.00 to 3.51, UNIVERGE Aspire UX from 1.00 to 9.70, UNIVERGE SV9100 from 1.00 to 10.70, and SL2100 from 1.00 to 3.00"
}
]
}
}
]
},
"vendor_name": "NEC Platforms, Ltd."
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "UNIVERGE Aspire series PBX (UNIVERGE Aspire WX from 1.00 to 3.51, UNIVERGE Aspire UX from 1.00 to 9.70, UNIVERGE SV9100 from 1.00 to 10.70, and SL2100 from 1.00 to 3.00) allows a remote authenticated attacker to cause system down and a denial of service (DoS) condition by sending a specially crafted command."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Denial-of-service (DoS)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.necplatforms.co.jp/en/press/security_adv.html",
"refsource": "MISC",
"url": "https://www.necplatforms.co.jp/en/press/security_adv.html"
},
{
"name": "https://jvn.jp/en/jp/JVN12737530/index.html",
"refsource": "MISC",
"url": "https://jvn.jp/en/jp/JVN12737530/index.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2021-20677",
"datePublished": "2021-03-26T08:50:26",
"dateReserved": "2020-12-17T00:00:00",
"dateUpdated": "2024-08-03T17:45:45.461Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"fkie_nvd": {
"configurations": "[{\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:necplatforms:univerge_aspire_wx_firmware:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"1.00\", \"versionEndIncluding\": \"3.51\", \"matchCriteriaId\": \"9C1A17B4-9A99-4772-BEE5-D69D6B4B4BEE\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:necplatforms:univerge_aspire_wx:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"E57AF072-9F43-4F37-891B-1B68BA1D9C91\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:necplatforms:univerge_aspire_ux_firmware:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"1.00\", \"versionEndIncluding\": \"9.70\", \"matchCriteriaId\": \"BE390008-23F2-44BD-863C-C574DD7A97E0\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:necplatforms:univerge_aspire_ux:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"A68A0CB3-7B3C-431D-A339-4CF1C5EBC0C6\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:necplatforms:univerge_sv9100_firmware:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"1.00\", \"versionEndIncluding\": \"10.70\", \"matchCriteriaId\": \"D611FCE0-8B1B-43C3-BBE9-E7FA6801F947\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:necplatforms:univerge_sv9100:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"38FE4F0F-5112-4214-A8E0-A4858F368C69\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:necplatforms:sl2100_firmware:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"1.00\", \"versionEndIncluding\": \"3.00\", \"matchCriteriaId\": \"36778BAB-500F-444F-93F4-FBBE28ECDB40\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:necplatforms:sl2100:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"129B972F-8F69-48B8-B2A2-E3AD109EF05F\"}]}]}]",
"descriptions": "[{\"lang\": \"en\", \"value\": \"UNIVERGE Aspire series PBX (UNIVERGE Aspire WX from 1.00 to 3.51, UNIVERGE Aspire UX from 1.00 to 9.70, UNIVERGE SV9100 from 1.00 to 10.70, and SL2100 from 1.00 to 3.00) allows a remote authenticated attacker to cause system down and a denial of service (DoS) condition by sending a specially crafted command.\"}, {\"lang\": \"es\", \"value\": \"UNIVERGE Aspire series PBX (UNIVERGE Aspire WX desde versiones 1.00 hasta 3.51, UNIVERGE Aspire UX desde versiones 1.00 hasta 9.70, UNIVERGE SV9100 desde versiones 1.00 hasta 10.70 y SL2100 desde versiones 1.00 hasta 3.00) permite a un atacante autenticado remoto causar la ca\\u00edda del sistema y una denegaci\\u00f3n de servicio ( DoS) mediante el env\\u00edo de un comando especialmente dise\\u00f1ado.\"}]",
"id": "CVE-2021-20677",
"lastModified": "2024-11-21T05:46:59.470",
"metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L\", \"baseScore\": 3.1, \"baseSeverity\": \"LOW\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"LOW\"}, \"exploitabilityScore\": 1.6, \"impactScore\": 1.4}], \"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:M/Au:S/C:N/I:N/A:P\", \"baseScore\": 3.5, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"MEDIUM\", \"authentication\": \"SINGLE\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"PARTIAL\"}, \"baseSeverity\": \"LOW\", \"exploitabilityScore\": 6.8, \"impactScore\": 2.9, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": false}]}",
"published": "2021-03-26T09:15:11.950",
"references": "[{\"url\": \"https://jvn.jp/en/jp/JVN12737530/index.html\", \"source\": \"vultures@jpcert.or.jp\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://www.necplatforms.co.jp/en/press/security_adv.html\", \"source\": \"vultures@jpcert.or.jp\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"https://jvn.jp/en/jp/JVN12737530/index.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://www.necplatforms.co.jp/en/press/security_adv.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Vendor Advisory\"]}]",
"sourceIdentifier": "vultures@jpcert.or.jp",
"vulnStatus": "Modified",
"weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"NVD-CWE-noinfo\"}]}]"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2021-20677\",\"sourceIdentifier\":\"vultures@jpcert.or.jp\",\"published\":\"2021-03-26T09:15:11.950\",\"lastModified\":\"2024-11-21T05:46:59.470\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"UNIVERGE Aspire series PBX (UNIVERGE Aspire WX from 1.00 to 3.51, UNIVERGE Aspire UX from 1.00 to 9.70, UNIVERGE SV9100 from 1.00 to 10.70, and SL2100 from 1.00 to 3.00) allows a remote authenticated attacker to cause system down and a denial of service (DoS) condition by sending a specially crafted command.\"},{\"lang\":\"es\",\"value\":\"UNIVERGE Aspire series PBX (UNIVERGE Aspire WX desde versiones 1.00 hasta 3.51, UNIVERGE Aspire UX desde versiones 1.00 hasta 9.70, UNIVERGE SV9100 desde versiones 1.00 hasta 10.70 y SL2100 desde versiones 1.00 hasta 3.00) permite a un atacante autenticado remoto causar la ca\u00edda del sistema y una denegaci\u00f3n de servicio ( DoS) mediante el env\u00edo de un comando especialmente dise\u00f1ado.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L\",\"baseScore\":3.1,\"baseSeverity\":\"LOW\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":1.6,\"impactScore\":1.4}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:S/C:N/I:N/A:P\",\"baseScore\":3.5,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"SINGLE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"LOW\",\"exploitabilityScore\":6.8,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:necplatforms:univerge_aspire_wx_firmware:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"1.00\",\"versionEndIncluding\":\"3.51\",\"matchCriteriaId\":\"9C1A17B4-9A99-4772-BEE5-D69D6B4B4BEE\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:necplatforms:univerge_aspire_wx:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E57AF072-9F43-4F37-891B-1B68BA1D9C91\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:necplatforms:univerge_aspire_ux_firmware:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"1.00\",\"versionEndIncluding\":\"9.70\",\"matchCriteriaId\":\"BE390008-23F2-44BD-863C-C574DD7A97E0\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:necplatforms:univerge_aspire_ux:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A68A0CB3-7B3C-431D-A339-4CF1C5EBC0C6\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:necplatforms:univerge_sv9100_firmware:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"1.00\",\"versionEndIncluding\":\"10.70\",\"matchCriteriaId\":\"D611FCE0-8B1B-43C3-BBE9-E7FA6801F947\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:necplatforms:univerge_sv9100:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"38FE4F0F-5112-4214-A8E0-A4858F368C69\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:necplatforms:sl2100_firmware:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"1.00\",\"versionEndIncluding\":\"3.00\",\"matchCriteriaId\":\"36778BAB-500F-444F-93F4-FBBE28ECDB40\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:necplatforms:sl2100:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"129B972F-8F69-48B8-B2A2-E3AD109EF05F\"}]}]}],\"references\":[{\"url\":\"https://jvn.jp/en/jp/JVN12737530/index.html\",\"source\":\"vultures@jpcert.or.jp\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.necplatforms.co.jp/en/press/security_adv.html\",\"source\":\"vultures@jpcert.or.jp\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://jvn.jp/en/jp/JVN12737530/index.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.necplatforms.co.jp/en/press/security_adv.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]}]}}"
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…