TI-2021-03902 Aliases CVE-2021-20676 GHSA-h3xv-65m3-mq7c

Incorrect authorization in M-System DL8 series

LOW 21CWE-863Published 2021-03-18 · Updated 2024-08-03

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: None · Low · None
Fix status: No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-863.

Summary

M-System DL8 series (type A (DL8-A) versions prior to Ver3.0, type B (DL8-B) versions prior to Ver3.0, type C (DL8-C) versions prior to Ver3.0, type D (DL8-D) versions prior to Ver3.0, and type E (DL8-E) versions prior to Ver3.0) allows remote authenticated attackers to bypass access restriction and conduct prohibited operations via unspecified vectors.

Why it matters now

EPSS 0.00797 56th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
M-System Co., Ltd.	M-System DL8 series	type A (DL8-A) versions prior to Ver3.0, type B (DL8-B) versions prior to Ver3.0, type C (DL8-C) versions prior to Ver3.0, type D (DL8-D) versions prior to Ver3.0, and type E (DL8-E) versions prior to Ver3.0	—	No fix listed	CNA

M-System DL8 series VendorM-System Co., Ltd. Affected type A (DL8-A) versions prior to Ver3.0, type B (DL8-B) versions prior to Ver3.0, type C (DL8-C) versions prior to Ver3.0, type D (DL8-D) versions prior to Ver3.0, and type E (DL8-E) versions prior to Ver3.0 Fixed in — No fix listed CNA

CPE configurations NVD · 10

CPE	Versions	Role	Vendor
cpe:2.3:o:m-system:dl8-a_firmware::::::::	before 3.0.81	Vulnerable	M-System Co., Ltd.
cpe:2.3:h:m-system:dl8-a:-:::::::*	not specified by NVD	Running on	M-System Co., Ltd.
cpe:2.3:o:m-system:dl8-b_firmware::::::::	before 3.0.77	Vulnerable	M-System Co., Ltd.
cpe:2.3:h:m-system:dl8-b:-:::::::*	not specified by NVD	Running on	M-System Co., Ltd.
cpe:2.3:o:m-system:dl8-c_firmware::::::::	before 3.0.99	Vulnerable	M-System Co., Ltd.
cpe:2.3:h:m-system:dl8-c:-:::::::*	not specified by NVD	Running on	M-System Co., Ltd.
cpe:2.3:o:m-system:dl8-d_firmware::::::::	before 3.0.91	Vulnerable	M-System Co., Ltd.
cpe:2.3:h:m-system:dl8-d:-:::::::*	not specified by NVD	Running on	M-System Co., Ltd.
cpe:2.3:o:m-system:dl8-e_firmware::::::::	before 3.0.12	Vulnerable	M-System Co., Ltd.
cpe:2.3:h:m-system:dl8-e:-:::::::*	not specified by NVD	Running on	M-System Co., Ltd.

cpe:2.3:o:m-system:dl8-a_firmware:*:*:*:*:*:*:*:* Versions before 3.0.81 Vulnerable ·M-System Co., Ltd.
cpe:2.3:h:m-system:dl8-a:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·M-System Co., Ltd.
cpe:2.3:o:m-system:dl8-b_firmware:*:*:*:*:*:*:*:* Versions before 3.0.77 Vulnerable ·M-System Co., Ltd.
cpe:2.3:h:m-system:dl8-b:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·M-System Co., Ltd.
cpe:2.3:o:m-system:dl8-c_firmware:*:*:*:*:*:*:*:* Versions before 3.0.99 Vulnerable ·M-System Co., Ltd.
cpe:2.3:h:m-system:dl8-c:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·M-System Co., Ltd.
cpe:2.3:o:m-system:dl8-d_firmware:*:*:*:*:*:*:*:* Versions before 3.0.91 Vulnerable ·M-System Co., Ltd.
cpe:2.3:h:m-system:dl8-d:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·M-System Co., Ltd.
cpe:2.3:o:m-system:dl8-e_firmware:*:*:*:*:*:*:*:* Versions before 3.0.12 Vulnerable ·M-System Co., Ltd.
cpe:2.3:h:m-system:dl8-e:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·M-System Co., Ltd.

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2021-20676
2026-10-03 Alias added: GHSA-h3xv-65m3-mq7c

References

Advisory 2

TI-2021-03901 M-System DL8 series (type A (DL8-A) versions prior to Ver3.0, type B (DL8-B) versions… CVSS 3.1MEDIUM 6.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences