var-202112-2053
Vulnerability from variot

Trendnet AC2600 TEW-827DRU version 2.08B01 improperly discloses credentials for the smb functionality of the device. Usernames and passwords for all smb users are revealed in plaintext on the smbserver.asp page. Trendnet AC2600 TEW-827DRU There are vulnerabilities in inadequate protection of credentials.Information may be obtained. Trendnet AC2600 TEW-827DRU is a wireless router.

An information disclosure vulnerability exists in the Trendnet AC2600 TEW-827DRU that stems from failing to properly disclose credentials for the device's smb capabilities. An attacker can exploit the vulnerability to display the username and password of all mb users in clear text on the mbserver.asp page

Show details on source website

To clipboard 

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-202112-2053",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "tew-827dru",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "trendnet",
        "version": "2.08b01"
      },
      {
        "model": "tew-827dru",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "trendnet",
        "version": null
      },
      {
        "model": "tew-827dru",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "trendnet",
        "version": "tew-827dru  firmware  2.08b01"
      },
      {
        "model": "ac2600 tew-827dru 2.08b01",
        "scope": null,
        "trust": 0.6,
        "vendor": "trendnet",
        "version": null
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2022-03204"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2021-017219"
      },
      {
        "db": "NVD",
        "id": "CVE-2021-20164"
      }
    ]
  },
  "cve": "CVE-2021-20164",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "author": "nvd@nist.gov",
            "availabilityImpact": "NONE",
            "baseScore": 4.0,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 8.0,
            "id": "CVE-2021-20164",
            "impactScore": 2.9,
            "integrityImpact": "NONE",
            "severity": "MEDIUM",
            "trust": 1.9,
            "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
            "version": "2.0"
          },
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "author": "CNVD",
            "availabilityImpact": "NONE",
            "baseScore": 4.0,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 8.0,
            "id": "CNVD-2022-03204",
            "impactScore": 2.9,
            "integrityImpact": "NONE",
            "severity": "MEDIUM",
            "trust": 0.6,
            "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "author": "nvd@nist.gov",
            "availabilityImpact": "NONE",
            "baseScore": 4.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "exploitabilityScore": 1.2,
            "id": "CVE-2021-20164",
            "impactScore": 3.6,
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "trust": 1.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          {
            "attackComplexity": "Low",
            "attackVector": "Network",
            "author": "NVD",
            "availabilityImpact": "None",
            "baseScore": 4.9,
            "baseSeverity": "Medium",
            "confidentialityImpact": "High",
            "exploitabilityScore": null,
            "id": "CVE-2021-20164",
            "impactScore": null,
            "integrityImpact": "None",
            "privilegesRequired": "High",
            "scope": "Unchanged",
            "trust": 0.8,
            "userInteraction": "None",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2021-20164",
            "trust": 1.0,
            "value": "MEDIUM"
          },
          {
            "author": "NVD",
            "id": "CVE-2021-20164",
            "trust": 0.8,
            "value": "Medium"
          },
          {
            "author": "CNVD",
            "id": "CNVD-2022-03204",
            "trust": 0.6,
            "value": "MEDIUM"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-202112-2810",
            "trust": 0.6,
            "value": "MEDIUM"
          },
          {
            "author": "VULMON",
            "id": "CVE-2021-20164",
            "trust": 0.1,
            "value": "MEDIUM"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2022-03204"
      },
      {
        "db": "VULMON",
        "id": "CVE-2021-20164"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2021-017219"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202112-2810"
      },
      {
        "db": "NVD",
        "id": "CVE-2021-20164"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Trendnet AC2600 TEW-827DRU version 2.08B01 improperly discloses credentials for the smb functionality of the device. Usernames and passwords for all smb users are revealed in plaintext on the smbserver.asp page. Trendnet AC2600 TEW-827DRU There are vulnerabilities in inadequate protection of credentials.Information may be obtained. Trendnet AC2600 TEW-827DRU is a wireless router. \n\r\n\r\nAn information disclosure vulnerability exists in the Trendnet AC2600 TEW-827DRU that stems from failing to properly disclose credentials for the device\u0027s smb capabilities. An attacker can exploit the vulnerability to display the username and password of all mb users in clear text on the mbserver.asp page",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2021-20164"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2021-017219"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2022-03204"
      },
      {
        "db": "VULMON",
        "id": "CVE-2021-20164"
      }
    ],
    "trust": 2.25
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2021-20164",
        "trust": 3.9
      },
      {
        "db": "TENABLE",
        "id": "TRA-2021-54",
        "trust": 3.1
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2021-017219",
        "trust": 0.8
      },
      {
        "db": "CNVD",
        "id": "CNVD-2022-03204",
        "trust": 0.6
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202112-2810",
        "trust": 0.6
      },
      {
        "db": "VULMON",
        "id": "CVE-2021-20164",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2022-03204"
      },
      {
        "db": "VULMON",
        "id": "CVE-2021-20164"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2021-017219"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202112-2810"
      },
      {
        "db": "NVD",
        "id": "CVE-2021-20164"
      }
    ]
  },
  "id": "VAR-202112-2053",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2022-03204"
      }
    ],
    "trust": 1.3868421
  },
  "iot_taxonomy": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "category": [
          "Network device"
        ],
        "sub_category": null,
        "trust": 0.6
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2022-03204"
      }
    ]
  },
  "last_update_date": "2024-08-14T13:22:58.392000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "Top\u00a0Page",
        "trust": 0.8,
        "url": "https://www.trendnet.com/"
      },
      {
        "title": "Patch for Trendnet AC2600 TEW-827DRU Information Disclosure Vulnerability",
        "trust": 0.6,
        "url": "https://www.cnvd.org.cn/patchInfo/show/313361"
      },
      {
        "title": "Trendnet AC2600 Repair measures for information disclosure vulnerabilities",
        "trust": 0.6,
        "url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=176858"
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2022-03204"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2021-017219"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202112-2810"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-522",
        "trust": 1.0
      },
      {
        "problemtype": "Inadequate protection of credentials (CWE-522) [NVD evaluation ]",
        "trust": 0.8
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2021-017219"
      },
      {
        "db": "NVD",
        "id": "CVE-2021-20164"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 3.1,
        "url": "https://www.tenable.com/security/research/tra-2021-54"
      },
      {
        "trust": 1.4,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2021-20164"
      },
      {
        "trust": 0.1,
        "url": "https://cwe.mitre.org/data/definitions/522.html"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov"
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2022-03204"
      },
      {
        "db": "VULMON",
        "id": "CVE-2021-20164"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2021-017219"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202112-2810"
      },
      {
        "db": "NVD",
        "id": "CVE-2021-20164"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "CNVD",
        "id": "CNVD-2022-03204"
      },
      {
        "db": "VULMON",
        "id": "CVE-2021-20164"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2021-017219"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202112-2810"
      },
      {
        "db": "NVD",
        "id": "CVE-2021-20164"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2022-01-13T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2022-03204"
      },
      {
        "date": "2021-12-30T00:00:00",
        "db": "VULMON",
        "id": "CVE-2021-20164"
      },
      {
        "date": "2023-01-10T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2021-017219"
      },
      {
        "date": "2021-12-30T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-202112-2810"
      },
      {
        "date": "2021-12-30T22:15:09.317000",
        "db": "NVD",
        "id": "CVE-2021-20164"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2022-01-13T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2022-03204"
      },
      {
        "date": "2022-01-07T00:00:00",
        "db": "VULMON",
        "id": "CVE-2021-20164"
      },
      {
        "date": "2023-01-10T06:46:00",
        "db": "JVNDB",
        "id": "JVNDB-2021-017219"
      },
      {
        "date": "2022-01-10T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-202112-2810"
      },
      {
        "date": "2022-01-07T17:40:31.660000",
        "db": "NVD",
        "id": "CVE-2021-20164"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-202112-2810"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Trendnet\u00a0AC2600\u00a0TEW-827DRU\u00a0 Vulnerability regarding insufficient protection of authentication information in",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2021-017219"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "information disclosure",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-202112-2810"
      }
    ],
    "trust": 0.6
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.