Vulnerabilities

TI-2021-16630 CVE-2021-39245 · GHSA-2cj7-p53m-r9v6

Hardcoded .htaccess Credentials for getlogs.cgi exist on Altus Nexto, Nexto Xpress, and…

LOW 36

Hardcoded .htaccess Credentials for getlogs.cgi exist on Altus Nexto, Nexto Xpress, and Hadron Xtorm devices.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01346 Published 2021-08-23 No fix listed CWE-798

TI-2021-16629 CVE-2021-39244 · GHSA-xq3m-82wp-9899

Authenticated Semi-Blind Command Injection (via Parameter Injection) exists on Altus…

MEDIUM 44

Authenticated Semi-Blind Command Injection (via Parameter Injection) exists on Altus Nexto, Nexto Xpress, and Hadron Xtorm devices via the getlogs.cgi tcpdump feature.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.03484 Published 2021-08-23 No fix listed CWE-78

TI-2021-16628 CVE-2021-39243 · GHSA-grc5-g2g9-cc7h

Cross-Site Request Forgery (CSRF) exists on Altus Nexto, Nexto Xpress, and Hadron Xtorm…

LOW 30

Cross-Site Request Forgery (CSRF) exists on Altus Nexto, Nexto Xpress, and Hadron Xtorm devices via any CGI endpoint.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00535 Published 2021-08-23 No fix listed CWE-352

Vulnerabilities

Filters

Hardcoded .htaccess Credentials for getlogs.cgi exist on Altus Nexto, Nexto Xpress, and…

Authenticated Semi-Blind Command Injection (via Parameter Injection) exists on Altus…

Cross-Site Request Forgery (CSRF) exists on Altus Nexto, Nexto Xpress, and Hadron Xtorm…