CVE-2021-39291

Certain NetModule devices allow credentials via GET parameters to CLI-PHP. These models with firmware before 4.3.0.113, 4.4.0.111, and 4.5.0.105 are affected: NB800, NB1600, NB1601, NB1800, NB1810, NB2700, NB2710, NB2800, NB2810, NB3700, NB3701, NB3710, NB3711, NB3720, and NB3800.
References
Link Resource
https://seclists.org/fulldisclosure/2021/Aug/22 Exploit Mailing List Third Party Advisory
https://www.netmodule.com Vendor Advisory
Advertisement

NeevaHost hosting service

Configurations

Configuration 1 (hide)

AND
OR cpe:2.3:o:netmodule:nb800_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:netmodule:nb800_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:netmodule:nb800_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:netmodule:nb800:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
OR cpe:2.3:o:netmodule:nb1600_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:netmodule:nb1600_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:netmodule:nb1600_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:netmodule:nb1600:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND
OR cpe:2.3:o:netmodule:nb1601_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:netmodule:nb1601_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:netmodule:nb1601_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:netmodule:nb1601:-:*:*:*:*:*:*:*

Configuration 4 (hide)

AND
OR cpe:2.3:o:netmodule:nb1800_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:netmodule:nb1800_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:netmodule:nb1800_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:netmodule:nb1800:-:*:*:*:*:*:*:*

Configuration 5 (hide)

AND
OR cpe:2.3:o:netmodule:nb1810_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:netmodule:nb1810_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:netmodule:nb1810_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:netmodule:nb1810:-:*:*:*:*:*:*:*

Configuration 6 (hide)

AND
OR cpe:2.3:o:netmodule:nb2700_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:netmodule:nb2700_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:netmodule:nb2700_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:netmodule:nb2700:-:*:*:*:*:*:*:*

Configuration 7 (hide)

AND
OR cpe:2.3:o:netmodule:nb2710_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:netmodule:nb2710_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:netmodule:nb2710_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:netmodule:nb2710:-:*:*:*:*:*:*:*

Configuration 8 (hide)

AND
OR cpe:2.3:o:netmodule:nb2800_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:netmodule:nb2800_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:netmodule:nb2800_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:netmodule:nb2800:-:*:*:*:*:*:*:*

Configuration 9 (hide)

AND
OR cpe:2.3:o:netmodule:nb2810_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:netmodule:nb2810_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:netmodule:nb2810_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:netmodule:nb2810:-:*:*:*:*:*:*:*

Configuration 10 (hide)

AND
OR cpe:2.3:o:netmodule:nb3700_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:netmodule:nb3700_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:netmodule:nb3700_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:netmodule:nb3700:-:*:*:*:*:*:*:*

Configuration 11 (hide)

AND
OR cpe:2.3:o:netmodule:nb3701_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:netmodule:nb3701_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:netmodule:nb3701_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:netmodule:nb3701:-:*:*:*:*:*:*:*

Configuration 12 (hide)

AND
OR cpe:2.3:o:netmodule:nb3710_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:netmodule:nb3710_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:netmodule:nb3710_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:netmodule:nb3710:-:*:*:*:*:*:*:*

Configuration 13 (hide)

AND
OR cpe:2.3:o:netmodule:nb3711_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:netmodule:nb3711_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:netmodule:nb3711_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:netmodule:nb3711:-:*:*:*:*:*:*:*

Configuration 14 (hide)

AND
OR cpe:2.3:o:netmodule:nb3720_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:netmodule:nb3720_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:netmodule:nb3720_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:netmodule:nb3720:-:*:*:*:*:*:*:*

Configuration 15 (hide)

AND
OR cpe:2.3:o:netmodule:nb3800_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:netmodule:nb3800_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:netmodule:nb3800_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:netmodule:nb3800:-:*:*:*:*:*:*:*

Information

Published : 2021-08-22 22:15

Updated : 2022-07-12 10:42


NVD link : CVE-2021-39291

Mitre link : CVE-2021-39291


JSON object : View

CWE
CWE-532

Insertion of Sensitive Information into Log File

Advertisement

dedicated server usa

Products Affected

netmodule

  • nb3711
  • nb3701_firmware
  • nb3800
  • nb3700
  • nb1600
  • nb3720
  • nb1601
  • nb2810_firmware
  • nb2710
  • nb1810_firmware
  • nb1810
  • nb3720_firmware
  • nb3710
  • nb3710_firmware
  • nb3800_firmware
  • nb3700_firmware
  • nb2700
  • nb3711_firmware
  • nb800_firmware
  • nb3701
  • nb1800_firmware
  • nb2800_firmware
  • nb2700_firmware
  • nb2710_firmware
  • nb800
  • nb1800
  • nb2800
  • nb1601_firmware
  • nb2810
  • nb1600_firmware