Vulnerability · Published Jan 27, 2022 · Assigned by TR-CERT

CVE-2021-44793Information Leakege via Unauthorized Access in Single Connect

High 8.6

In plain English

A high-severity missing authorization in Single Connect from Kron. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 68% of all known vulnerabilities).

Severity (CVSS 3.1)8.6High

Exploit odds (30 days)1.2%top 32.0% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Single Connect does not perform an authorization check when using the sc-reports-ui" module. A remote attacker could exploit this vulnerability to access the device configuration page and export the data to an external file. The exploitation of this vulnerability might allow a remote attacker to obtain sensitive information including the database credentials. Since the database runs with high privileges it is possible to execute commands with the attained credentials.

Affected products (as reported)

Vendor	Product	Versions
Kron	Single Connect	unspecified – before 2.16

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

References

https://www.usom.gov.tr/bildirim/tr-22-0093 government-resource, broken-link
https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-22-0093 government-resource