What is the CVSS score of CVE-2021-37189?

CVE-2021-37189 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.6%.

Transport Wr11 Firmware CVE-2021-37189

HIGH

Missing Encryption of Sensitive Data (CWE-311)

2021-12-10 cve@mitre.org

Information Disclosure Transport Wr11 Firmware Transport Wr11 Xt Firmware Transport Wr21 Firmware Transport Wr31 Firmware Transport Wr41 Firmware Transport Wr44 Firmware

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

CVE Published

Dec 10, 2021 - 13:15 nvd

HIGH 7.5

DescriptionNVD

An issue was discovered on Digi TransPort Gateway devices through 5.2.13.4. They do not set the Secure attribute for sensitive cookies in HTTPS sessions, which could cause the user agent to send those cookies in cleartext over an HTTP session.

AnalysisAI

An issue was discovered on Digi TransPort Gateway devices through 5.2.13.4. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-311. An issue was discovered on Digi TransPort Gateway devices through 5.2.13.4. They do not set the Secure attribute for sensitive cookies in HTTPS sessions, which could cause the user agent to send those cookies in cleartext over an HTTP session. Affected products include: Digi Transport Wr11 Firmware, Digi Transport Wr11 Xt Firmware, Digi Transport Wr21 Firmware, Digi Transport Wr31 Firmware, Digi Transport Wr41 Firmware. Version information: through 5.2.13.4..

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.