Low severity · published Aug 5, 2021
CVE-2021-32002
SiteManager troubleshooter allows access without authentication from local network
3.3
CVSS
0.2%
EPSS
No
On KEV
Description
Improper Access Control vulnerability in web service of Secomea SiteManager allows local attacker without credentials to gather network information and configuration of the SiteManager. This issue affects: Secomea SiteManager All versions prior to 9.5 on Hardware.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 14% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SI
SiteManager · Secomea
All before 9.5 · source: vendor
SF
Sitemanager Firmware · Secomea
before 9.5.621256022 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-32002
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-32002
Vendor Advisory
https://www.secomea.com/support/cybersecurity-advisory
More from SiteManager
8.1
CVE-2021-32010
Clients may connect to a GateManager with TLS 1.0
7.2
CVE-2022-25785
Buffer overrun
7.2
CVE-2020-29020
Reject Remote Management via Cellular UPLINK2
6.5
CVE-2022-38124
Unwanted debug tool
5.5
CVE-2022-38125
FTP Agent forwards traffic on inactive ports to LinkManager