CVE-2021-25681: High severity Adtran Personal Phone Manager vulnerability
UNSUPPORTED WHEN ASSIGNED AdTran Personal Phone Manager 10.8.1 software is vulnerable to an issue that allows for exfiltration of data over DNS. This could allow for exposed AdTran Personal Phone Manager web servers to be used as DNS redirectors to tunnel arbitrary data over DNS. NOTE: The affected appliances NetVanta 7060 and NetVanta 7100 are considered End of Life and as such this issue will not be patched.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Because AdTran Personal Phone Manager 10.8.1 and the affected appliances NetVanta 7060 and NetVanta 7100 are End of Life and will not be patched, prevent exposed AdTran Personal Phone Manager web servers from being used as DNS redirectors by restricting/isolating network access to those web servers (e.g., limit inbound access to only required sources and block unauthorized DNS-related traffic at the network perimeter).
Event History
Frequently Asked Questions
What is the severity of CVE-2021-25681?
CVE-2021-25681 is classified as a medium severity vulnerability due to its potential for data exfiltration over DNS.
How do I fix CVE-2021-25681?
To fix CVE-2021-25681, users should upgrade to a patched version of AdTran Personal Phone Manager, if available.
What type of vulnerability is CVE-2021-25681?
CVE-2021-25681 is a vulnerability that allows for the exfiltration of data over DNS.
What are the potential impacts of CVE-2021-25681?
The potential impacts of CVE-2021-25681 include unauthorized data access and the possibility of using affected systems as DNS redirectors.
Which software versions are affected by CVE-2021-25681?
CVE-2021-25681 specifically affects AdTran Personal Phone Manager version 10.8.1.