What is the CVSS score of CVE-2021-37187?

CVE-2021-37187 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.7%.

Transport Dr64 Firmware CVE-2021-37187

MEDIUM

Insufficiently Protected Credentials (CWE-522)

2021-12-10 cve@mitre.org

Information Disclosure Transport Dr64 Firmware Transport Vc74 Firmware Transport Wr11 Firmware Transport Wr11 Xt Firmware Transport Wr21 Firmware Transport Wr31 Firmware Transport Wr41 Firmware Transport Wr44 Firmware

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

CVE Published

Dec 10, 2021 - 13:15 nvd

MEDIUM 6.5

DescriptionNVD

An issue was discovered on Digi TransPort devices through 2021-07-21. An authenticated attacker may read a password file (with reversible passwords) from the device, which allows decoding of other users' passwords.

AnalysisAI

An issue was discovered on Digi TransPort devices through 2021-07-21. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Insufficiently Protected Credentials (CWE-522), which allows attackers to obtain user credentials due to weak protection mechanisms. An issue was discovered on Digi TransPort devices through 2021-07-21. An authenticated attacker may read a password file (with reversible passwords) from the device, which allows decoding of other users' passwords. Affected products include: Digi Transport Dr64 Firmware, Digi Transport Vc74 Firmware, Digi Transport Wr11 Firmware, Digi Transport Wr11 Xt Firmware, Digi Transport Wr21 Firmware. Version information: through 2021.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Hash passwords with strong algorithms (bcrypt, argon2), encrypt credentials in transit and at rest, never log credentials.