CVE-2021-21902

An authentication bypass vulnerability exists in the CMA run_server_6877 functionality of Garrett Metal Detectors iC Module CMA Version 5.0. A properly-timed network connection can lead to authentication bypass via session hijacking. An attacker can send a sequence of requests to trigger this vulnerability.

CVSS v3.1

8.1 HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v3.0

7.5 HIGHCVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

CVSS v2.0

9.3 HIGHAV:N/AC:M/Au:N/C:C/I:C/A:C

EPSS

1.72% chance of exploitation in the next 30 days, 76th percentile

Published

2021-12-22

Updated

2024-08-03

Proof-of-concept exploits (1)

• https://talosintelligence.com/vulnerability_reports/TALOS-2021-1354

References

• CVE Record
• NVD entry

Related

• CVE-2021-21901
• CVE-2021-21903
• CVE-2021-21900
• CVE-2021-21904
• CVE-2021-21899
• CVE-2021-21905