CVE-2021-26729

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Command injection and multiple stack-based buffer overflows vulnerabilities in the Login_handler_func function of spx_restservice allow an attacker to execute arbitrary code with the same privileges as the server user (root). This issue affects: Lanner Inc IAC-AST2500A standard firmware version 1.10.0.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94 CWE-121 CWE-77 CWE-787

Affected software

Vendor	Product	Versions
Lanner Inc	IAC-AST2500A	1.10.0

References

https://www.nozominetworks.com/blog/vulnerabilities-in-bmc-firmware-affect-ot-iot-device-security-part-1/Third Party Advisory
https://www.nozominetworks.com/labs/vulnerability-advisories/cve-2021-26729/Third Party Advisory
https://www.nozominetworks.com/blog/vulnerabilities-in-bmc-firmware-affect-ot-iot-device-security-part-1/Third Party Advisory
https://www.nozominetworks.com/labs/vulnerability-advisories/cve-2021-26729/Third Party Advisory

Timeline

Published: Oct 24, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-267309.8A stack-based buffer overflow vulnerability in a subfunction of the Login_handler_func function of spx_restservice allows an attacker to exe CVE-2021-267319.8Command injection and multiple stack-based buffer overflows vulnerabilities in the modifyUserb_func function of spx_restservice allow an aut CVE-2021-267325.3A broken access control vulnerability in the First_network_func function of spx_restservice allows an attacker to arbitrarily change the net CVE-2021-267337.5A broken access control vulnerability in the FirstReset_handler_func function of spx_restservice allows an attacker to arbitrarily send rebo CVE-2021-267345.5Zscaler Client Connector Installer on Windows before version 3.4.0.124 improperly handled directory junctions during uninstallation. A local CVE-2021-267357.8The Zscaler Client Connector Installer and Unsintallers for Windows prior to 3.6 had an unquoted search path vulnerability. A local adversar CVE-2021-267367.8Multiple vulnerabilities in the Zscaler Client Connector Installer and Uninstaller for Windows prior to 3.6 allowed execution of binaries fr CVE-2021-267374.7The Zscaler Client Connector for macOS prior to 3.6 did not sufficiently validate RPC clients. A local adversary without sufficient privileg CVE-2021-267387.8Zscaler Client Connector for macOS prior to 3.7 had an unquoted search path vulnerability via the PATH variable. A local adversary may be ab CVE-2021-267399.8SQL Injection vulnerability in pay.php in millken doyocms 2.3, allows attackers to execute arbitrary code, via the attribute parameter.CVE-2021-267409.8Arbitrary file upload vulnerability sysupload.php in millken doyocms 2.3 allows attackers to execute arbitrary code.CVE-2021-267466.1Chamilo 1.11.14 allows XSS via a main/calendar/agenda_list.php?type= URI.