CVE-2021-26637CWE-287

SiHAS Improper Authentication vulnerability

High · published June 22, 2022

CVSS v3.1
8.8
EPSS
2%
Percentile
79.7
In the wild
Unconfirmed
What it is

There is no account authentication and permission check logic in the firmware and existing apps of SiHAS's SGW-300, ACM-300, GCM-300, so unauthorized users can remotely control the device.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01915 · 79.7th percentile
Weakness
CWE-287 · Improper Authentication
Published
2022-06-22T13:55Z
EPSS history
Timeline
  • 22 JUN 13:55Z
    SiHAS Improper Authentication vulnerability
    cvelistv5