CVE-2021-32002

LowCVSS 3.3/10Last modified Jun 17, 2026

Description

Improper Access Control vulnerability in web service of Secomea SiteManager allows local attacker without credentials to gather network information and configuration of the SiteManager. This issue affects: Secomea SiteManager All versions prior to 9.5 on Hardware.

Metrics

CVSS 3.1 3.3/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200 CWE-284

Affected software

Vendor	Product	Versions
Secomea	SiteManager	>= All, < 9.5

References

https://www.secomea.com/support/cybersecurity-advisoryVendor Advisory
https://www.secomea.com/support/cybersecurity-advisoryVendor Advisory

Timeline

Published: Aug 5, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-320035.5Unprotected Transport of Credentials vulnerability in SiteManager provisioning service allows local attacker to capture credentials if the s CVE-2021-320045.3This issue affects: Secomea GateManager All versions prior to 9.6. Improper Check of host header in web server of Secomea GateManager allows CVE-2021-320055.4Cross-site Scripting (XSS) vulnerability in log view of Secomea SiteManager allows a logged in user to store javascript for later execution.CVE-2021-320064.3This issue affects: Secomea GateManager Version 9.6.621421014 and all prior versions. Permission Issues vulnerability in LinkManager web por CVE-2021-320073.5This issue affects: Secomea GateManager Version 9.5 and all prior versions. Protection Mechanism Failure vulnerability in web server of Seco CVE-2021-320088.7This issue affects: Secomea GateManager Version 9.6.621421014 and all prior versions. Improper Limitation of a Pathname to restricted direct CVE-2021-320096.1Cross-site Scripting (XSS) vulnerability in firmware section of Secomea GateManager allows logged in user to inject javascript in browser se CVE-2021-320108.1Inadequate Encryption Strength vulnerability in TLS stack of Secomea SiteManager, LinkManager, GateManager may facilitate man in the middle CVE-2021-320125.5SheetJS and SheetJS Pro through 0.16.9 allows attackers to cause a denial of service (memory consumption) via a crafted .xlsx document that CVE-2021-320135.5SheetJS and SheetJS Pro through 0.16.9 allows attackers to cause a denial of service (memory consumption) via a crafted .xlsx document that CVE-2021-320145.5SheetJS and SheetJS Pro through 0.16.9 allows attackers to cause a denial of service (CPU consumption) via a crafted .xlsx document that is CVE-2021-320156.0In Nuvoton NPCT75x TPM 1.2 firmware 7.4.0.0, a local authenticated malicious user with high privileges could potentially gain unauthorized a