CVE-2021-35508

NMSAccess32.exe in TeraRecon AQNetClient 4.4.13 allows attackers to execute a malicious binary with SYSTEM privileges via a low-privileged user account. To exploit this, a low-privileged user must change the service configuration or overwrite the binary service.

CVSS v3 8.8 HIGH
CVSS v2.0 8.5 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

8.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:M/Au:S/C:C/I:C/A:C

Exploitability : 6.8 / Impact : 10.0

Access Vector NETWORK

Access Complexity MEDIUM

Authentication SINGLE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
https://terarecon.sharefile.com/d-s05c8b7792f354a2d8115789a02449c4a	Product Third Party Advisory
https://www.linkedin.com/pulse/cve-2021-35508-privilege-escalation-via-weak-windows-marshall-mba	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:terarecon:aquariusnet:4.4.13:*:*:*:*:*:*:*

History

No history.

Information

Published : 2021-09-01 14:15

Updated : 2022-07-12 17:42

NVD link : CVE-2021-35508

Mitre link : CVE-2021-35508

CVE.ORG link : CVE-2021-35508

JSON object : View

Products Affected

terarecon

aquariusnet

CWE

CWE-732

Incorrect Permission Assignment for Critical Resource

{"id": "CVE-2021-35508", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 8.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:S/C:C/I:C/A:C", "authentication": "SINGLE", "integrityImpact": "COMPLETE", "accessComplexity": "MEDIUM", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 6.8, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2021-09-01T14:15:07.813", "references": [{"url": "https://terarecon.sharefile.com/d-s05c8b7792f354a2d8115789a02449c4a", "tags": ["Product", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.linkedin.com/pulse/cve-2021-35508-privilege-escalation-via-weak-windows-marshall-mba", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-732"}]}], "descriptions": [{"lang": "en", "value": "NMSAccess32.exe in TeraRecon AQNetClient 4.4.13 allows attackers to execute a malicious binary with SYSTEM privileges via a low-privileged user account. To exploit this, a low-privileged user must change the service configuration or overwrite the binary service."}, {"lang": "es", "value": "NMSAccess32.exe en TeraRecon AQNetClient versi\u00f3n 4.4.13, permite a atacantes ejecutar un binario malicioso con privilegios SYSTEM por medio de una cuenta de usuario con pocos privilegios. Para explotar esto, un usuario con pocos privilegios debe cambiar la configuraci\u00f3n del servicio o sobrescribir el servicio binario.\nNMSAccess32.exe en TeraRecon AQNetClient versi\u00f3n 4.4.13, permite a atacantes ejecutar un binario malicioso con privilegios SYSTEM por medio de una cuenta de usuario con pocos privilegios. Para explotar esto, un usuario con pocos privilegios debe cambiar la configuraci\u00f3n del servicio o sobrescribir el servicio binario"}], "lastModified": "2022-07-12T17:42:04.277", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:terarecon:aquariusnet:4.4.13:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "64508F5B-B224-44FA-819B-9B735810FD91"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}