CVE-2021-33903
First published: Thu Oct 07 2021(Updated: )
In LCOS 10.40 to 10.42.0473-RU3 with SNMPv3 enabled on LANCOM devices, changing the password of the root user via the CLI does not change the password of the root user for SNMPv3 access. (However, changing the password of the root user via LANconfig does change the password of the root user for SNMPv3 access.)
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Lancom Systems LCOS | >=10.40<10.42.0473 | |
| Lancom Systems LCOS | =10.42.0473 | |
| Lancom Systems LCOS | =10.42.0473-release_update1 | |
| Lancom Systems LCOS | =10.42.0473-release_update2 | |
| Lancom Systems LCOS | =10.42.0473-release_update3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the severity of CVE-2021-33903?
CVE-2021-33903 is considered a medium severity vulnerability affecting LANCOM devices.
How do I fix CVE-2021-33903?
To mitigate CVE-2021-33903, ensure that the root user password is changed via LANconfig instead of the CLI.
Which devices are affected by CVE-2021-33903?
CVE-2021-33903 affects LANCOM devices running LCOS versions 10.40 through 10.42.0473 with SNMPv3 enabled.
What does CVE-2021-33903 affect in LANCOM devices?
CVE-2021-33903 affects the root user password synchronization between CLI and SNMPv3 access in LANCOM devices.
Is remote exploitation possible with CVE-2021-33903?
Yes, remote exploitation is possible with CVE-2021-33903 due to the SNMPv3 protocol weaknesses.
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/references
- agent/last-modified-date
- agent/author
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/lancom-systems
- canonical/lancom systems lcos
- version/lancom systems lcos/10.40
- version/lancom systems lcos/10.42.0473
- version/lancom systems lcos/10.42.0473-release_update1
- version/lancom systems lcos/10.42.0473-release_update2
- version/lancom systems lcos/10.42.0473-release_update3