CVE-2021-20653 - OpenCVE

Calsos CSDJ (CSDJ-B 01.08.00 and earlier, CSDJ-H 01.08.00 and earlier, CSDJ-D 01.08.00 and earlier, and CSDJ-A 03.08.00 and earlier) allows remote attackers to bypass access restriction and to obtain unauthorized historical data without access privileges via unspecified vectors.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

AV:N/AC:L/Au:N/C:P/I:N/A:N

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Nec	Csdj-a Csdj-a Firmware Csdj-b Csdj-b Firmware Csdj-d Csdj-d Firmware Csdj-h Csdj-h Firmware

Configuration 1 [-]

AND

cpe:2.3:o:nec:csdj-b_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:nec:csdj-b:-:*:*:*:*:*:*:*

Configuration 2 [-]

AND

cpe:2.3:o:nec:csdj-h_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:nec:csdj-h:-:*:*:*:*:*:*:*

Configuration 3 [-]

AND

cpe:2.3:o:nec:csdj-d_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:nec:csdj-d:-:*:*:*:*:*:*:*

Configuration 4 [-]

AND

cpe:2.3:o:nec:csdj-a_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:nec:csdj-a:-:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://jpn.nec.com/security-info/secinfo/nv21-006.html
https://jvn.jp/en/jp/JVN87164507/index.html

History

No history.

MITRE

Status: PUBLISHED

Assigner: jpcert

Published: 2021-02-17T02:05:29

Updated: 2024-08-03T17:45:45.463Z

Reserved: 2020-12-17T00:00:00

Link: CVE-2021-20653

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2021-02-17T03:15:12.210

Modified: 2021-02-23T14:29:55.587

Link: CVE-2021-20653

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "Calsos CSDJ", "vendor": "NEC Platforms, Ltd.", "versions": [{"status": "affected", "version": "CSDJ-B 01.08.00 and earlier, CSDJ-H 01.08.00 and earlier, CSDJ-D 01.08.00 and earlier, and CSDJ-A 03.08.00 and earlier"}]}], "descriptions": [{"lang": "en", "value": "Calsos CSDJ (CSDJ-B 01.08.00 and earlier, CSDJ-H 01.08.00 and earlier, CSDJ-D 01.08.00 and earlier, and CSDJ-A 03.08.00 and earlier) allows remote attackers to bypass access restriction and to obtain unauthorized historical data without access privileges via unspecified vectors."}], "problemTypes": [{"descriptions": [{"description": "Fails to restrict access", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2021-02-17T02:05:29", "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "shortName": "jpcert"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://jpn.nec.com/security-info/secinfo/nv21-006.html"}, {"tags": ["x_refsource_MISC"], "url": "https://jvn.jp/en/jp/JVN87164507/index.html"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "vultures@jpcert.or.jp", "ID": "CVE-2021-20653", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Calsos CSDJ", "version": {"version_data": [{"version_value": "CSDJ-B 01.08.00 and earlier, CSDJ-H 01.08.00 and earlier, CSDJ-D 01.08.00 and earlier, and CSDJ-A 03.08.00 and earlier"}]}}]}, "vendor_name": "NEC Platforms, Ltd."}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Calsos CSDJ (CSDJ-B 01.08.00 and earlier, CSDJ-H 01.08.00 and earlier, CSDJ-D 01.08.00 and earlier, and CSDJ-A 03.08.00 and earlier) allows remote attackers to bypass access restriction and to obtain unauthorized historical data without access privileges via unspecified vectors."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Fails to restrict access"}]}]}, "references": {"reference_data": [{"name": "https://jpn.nec.com/security-info/secinfo/nv21-006.html", "refsource": "MISC", "url": "https://jpn.nec.com/security-info/secinfo/nv21-006.html"}, {"name": "https://jvn.jp/en/jp/JVN87164507/index.html", "refsource": "MISC", "url": "https://jvn.jp/en/jp/JVN87164507/index.html"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T17:45:45.463Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://jpn.nec.com/security-info/secinfo/nv21-006.html"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://jvn.jp/en/jp/JVN87164507/index.html"}]}]}, "cveMetadata": {"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "assignerShortName": "jpcert", "cveId": "CVE-2021-20653", "datePublished": "2021-02-17T02:05:29", "dateReserved": "2020-12-17T00:00:00", "dateUpdated": "2024-08-03T17:45:45.463Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:nec:csdj-b_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "60624A2B-2A3C-4333-A645-327DF825DD5C", "versionEndIncluding": "01.08.00", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:nec:csdj-b:-:*:*:*:*:*:*:*", "matchCriteriaId": "F4BD38A7-5D74-441C-8BBB-542932FA3C32", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:nec:csdj-h_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "B8DD7FC5-7ED4-481B-B4A0-B3144E4F0F1A", "versionEndIncluding": "01.08.00", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:nec:csdj-h:-:*:*:*:*:*:*:*", "matchCriteriaId": "81E05164-5B82-47BC-9B79-0DAFAB82D603", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:nec:csdj-d_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "377D780A-7893-46FB-A507-C05565B158B9", "versionEndIncluding": "01.08.00", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:nec:csdj-d:-:*:*:*:*:*:*:*", "matchCriteriaId": "7B30D061-6EB9-4524-AA80-41676777CFFE", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:nec:csdj-a_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "AA71F885-D385-4EBD-A544-9CDB5227C6C1", "versionEndIncluding": "03.08.00", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:nec:csdj-a:-:*:*:*:*:*:*:*", "matchCriteriaId": "FE75BF33-2910-48A9-915E-D043DA500E5C", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Calsos CSDJ (CSDJ-B 01.08.00 and earlier, CSDJ-H 01.08.00 and earlier, CSDJ-D 01.08.00 and earlier, and CSDJ-A 03.08.00 and earlier) allows remote attackers to bypass access restriction and to obtain unauthorized historical data without access privileges via unspecified vectors."}, {"lang": "es", "value": "Calsos CSDJ (CSDJ-B versiones 01.08.00 y anteriores, CSDJ-H versiones 01.08.00 y anteriores, CSDJ-D versiones 01.08.00 y anteriores, y CSDJ-A versiones 03.08.00 y anteriores), permite a atacantes remotos omitir la restricci\u00f3n de acceso y obtener datos hist\u00f3ricos no autorizados sin privilegios de acceso por medio de vectores no especificados"}], "id": "CVE-2021-20653", "lastModified": "2021-02-23T14:29:55.587", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2021-02-17T03:15:12.210", "references": [{"source": "vultures@jpcert.or.jp", "tags": ["Third Party Advisory"], "url": "https://jpn.nec.com/security-info/secinfo/nv21-006.html"}, {"source": "vultures@jpcert.or.jp", "tags": ["Third Party Advisory"], "url": "https://jvn.jp/en/jp/JVN87164507/index.html"}], "sourceIdentifier": "vultures@jpcert.or.jp", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-276"}], "source": "nvd@nist.gov", "type": "Primary"}]}