Skip to content
OpenAdvisories

Vendor

Lanner

13 known vulnerabilities.

Products

IAC-AST2500A 13
All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • Medium 5.8
    CVE-2021-4228

    Hard-coded TLS Certificate

    Use of hard-coded TLS certificate by default allows an attacker to perform Man-in-the-Middle (MitM) attacks even in the presence of the HTTPS connection. This issue affects: Lanner Inc IAC-AST2500A standard firmware version 1.00.0.

    Lanner IAC-AST2500A
  • Medium 5.8
    CVE-2021-46279

    Session Fixation and Insufficient Session Expiration

    Session fixation and insufficient session expiration vulnerabilities allow an attacker to perfom session hijacking attacks against users. This issue affects: Lanner Inc IAC-AST2500A standard firmware version 1.10.0.

    Lanner IAC-AST2500A
  • Medium 5.3
    CVE-2021-45925

    Username Enumeration

    Observable discrepancies in the login process allow an attacker to guess legitimate user names registered in the BMC. This issue affects: Lanner Inc IAC-AST2500A standard firmware version 1.10.0.

    Lanner IAC-AST2500A
  • Medium 6.5
    CVE-2021-44776

    spx_restservice SubNet_handler_func Broken Access Control

    A broken access control vulnerability in the SubNet_handler_func function of spx_restservice allows an attacker to arbitrarily change the security access rights to KVM and Virtual Media functionalities. This issue affects: Lanner Inc IAC-AST2500A standard fir…

    Lanner IAC-AST2500A
  • Medium 5.3
    CVE-2021-44467

    spx_restservice KillDupUsr_func Broken Access Control

    A broken access control vulnerability in the KillDupUsr_func function of spx_restservice allows an attacker to arbitrarily terminate active sessions of other users, causing a Denial-of-Service (DoS) condition, if an input parameter is correctly guessed. This …

    Lanner IAC-AST2500A
  • Medium 4.9
    CVE-2021-44769

    TLS Certificate Generation Function Improper Input Validation

    An improper input validation vulnerability in the TLS certificate generation function allows an attacker to cause a Denial-of-Service (DoS) condition which can only be reverted via a factory reset. This issue affects: Lanner Inc IAC-AST2500A standard firmware…

    Lanner IAC-AST2500A
  • Medium 6.5
    CVE-2021-26732

    spx_restservice First_network_func Broken Access Control

    A broken access control vulnerability in the First_network_func function of spx_restservice allows an attacker to arbitrarily change the network configuration of the BMC. This issue affects: Lanner Inc IAC-AST2500A standard firmware version 1.10.0.

    Lanner IAC-AST2500A
  • Medium 5.3
    CVE-2021-26733

    spx_restservice FirstReset_handler_func Broken Access Control

    A broken access control vulnerability in the FirstReset_handler_func function of spx_restservice allows an attacker to arbitrarily send reboot commands to the BMC, causing a Denial-of-Service (DoS) condition. This issue affects: Lanner Inc IAC-AST2500A standa…

    Lanner IAC-AST2500A