CVE-2021-3252

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

KACO New Energy XP100U Up to XP-JAVA 2.0 is affected by incorrect access control. Credentials will always be returned in plain-text from the local server during the KACO XP100U authentication process, regardless of whatever passwords have been provided, which leads to an information disclosure vulnerability.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-522

Affected software

No affected versions have been published.

Timeline

Published
Feb 23, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-325209.8Use of hard-coded cryptographic key vulnerability in QSAN Storage Manager allows attackers to obtain users’ credentials and related permissiCVE-2021-325219.8Use of MAC address as an authenticated password in QSAN Storage Manager, XEVO, SANOS allows local attackers to escalate privileges. Suggest CVE-2021-325229.8Improper restriction of excessive authentication attempts vulnerability in QSAN Storage Manager, XEVO, SANOS allows remote attackers to discCVE-2021-325237.2Improper authorization vulnerability in QSAN Storage Manager allows remote privileged users to bypass the access control and execute arbitraCVE-2021-325247.2Command injection vulnerability in QSAN Storage Manager allows remote privileged users to execute arbitrary commands. Suggest contacting witCVE-2021-325257.2The same hard-coded password in QSAN Storage Manager's in the firmware allows remote attackers to access the control interface with the admiCVE-2021-325266.5Incorrect permission assignment for critical resource vulnerability in QSAN Storage Manager allows authenticated remote attackers to access CVE-2021-325277.5Path traversal vulnerability in QSAN Storage Manager allows remote unauthenticated attackers to download arbitrary files thru injecting fileCVE-2021-325285.3Observable behavioral discrepancy vulnerability in QSAN Storage Manager allows remote attackers to obtain the system information without perCVE-2021-325299.8Command injection vulnerability in QSAN XEVO, SANOS allows remote unauthenticated attackers to execute arbitrary commands. Suggest contactinCVE-2021-325309.8OS command injection vulnerability in Array function in QSAN XEVO allows remote unauthenticated attackers to execute arbitrary commands via CVE-2021-325319.8OS command injection vulnerability in Init function in QSAN XEVO allows remote attackers to execute arbitrary commands without permissions.
CVE-2021-3252: High severity, CVSS 7.5 | Vulnix