CVE-2021-33903 : Security Advisory and Response

This article provides an overview of CVE-2021-33903, a vulnerability found in LCOS versions 10.40 to 10.42.0473-RU3 affecting LANCOM devices with SNMPv3 enabled. The vulnerability allows unauthorized access to SNMPv3 even after changing the root user's password via CLI.

Understanding CVE-2021-33903

CVE-2021-33903 is a security flaw in LANCOM devices running LCOS versions 10.40 to 10.42.0473-RU3 where changing the root user password via CLI does not update the SNMPv3 password.

What is CVE-2021-33903?

The vulnerability in LCOS versions 10.40 to 10.42.0473-RU3 allows unauthorized SNMPv3 access even after changing the root user password using the CLI. However, changing the password via LANconfig updates the SNMPv3 password.

The Impact of CVE-2021-33903

This issue could lead to unauthorized access to SNMPv3-protected information on LANCOM devices, posing a significant security risk to the network.

Technical Details of CVE-2021-33903

The technical details of CVE-2021-33903 include:

Vulnerability Description

Changing the root user password via CLI in LCOS versions 10.40 to 10.42.0473-RU3 does not synchronize with the SNMPv3 password, allowing unauthorized access.

Affected Systems and Versions

The vulnerability affects LANCOM devices running LCOS versions 10.40 to 10.42.0473-RU3 with SNMPv3 enabled.

Exploitation Mechanism

Attackers can exploit this vulnerability by accessing SNMPv3-protected data even after password changes, compromising network security.

Mitigation and Prevention

To mitigate CVE-2021-33903, consider the following steps:

Immediate Steps to Take

Change the root user password using LANconfig to update the SNMPv3 password.
Monitor SNMPv3 access for unauthorized activities.

Long-Term Security Practices

Implement regular password updates and monitor password synchronization.
Apply vendor-recommended patches and updates to address the vulnerability.

Patching and Updates

LANCOM device users should apply the latest patches and updates provided by the vendor to eliminate the CVE-2021-33903 vulnerability.