CVE-2021-41992

MediumCVSS 5.6/10Last modified Jun 17, 2026

Description

A misconfiguration of RSA in PingID Windows Login prior to 2.7 is vulnerable to pre-computed dictionary attacks, leading to an offline MFA bypass.

Metrics

CVSS 3.1 5.6/10CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N

Weakness enumeration

CWE-288CWE-310CWE-287

Affected software

VendorProductVersions
Ping IdentityPingID Windows Login>= unspecified, < 2.7

References

Timeline

Published
Apr 30, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-419934.8A misconfiguration of RSA in PingID Android app prior to 1.19 is vulnerable to pre-computed dictionary attacks, leading to an offline MFA byCVE-2021-419944.8A misconfiguration of RSA in PingID iOS app prior to 1.19 is vulnerable to pre-computed dictionary attacks, leading to an offline MFA bypassCVE-2021-419957.5A misconfiguration of RSA in PingID Mac Login prior to 1.1 is vulnerable to pre-computed dictionary attacks, leading to an offline MFA bypasCVE-2021-42005.4A Improper Privilege Management vulnerability in SUSE Rancher allows write access to the Catalog for any user when restricted-admin role is CVE-2021-420006.5When a password reset or password change flow with an authentication policy is configured and the adapter in the reset or change policy suppCVE-2021-420019.9PingID Desktop prior to 1.7.3 has a misconfiguration in the encryption libraries which can lead to sensitive data exposure. An attacker capaCVE-2021-420029.8Zoho ManageEngine ADManager Plus before 7115 is vulnerable to a filter bypass that leads to file-upload remote code execution.CVE-2021-420068.8An out-of-bounds access in GffLine::GffLine in gff.cpp in GCLib 0.12.7 allows an attacker to cause a segmentation fault or possibly have unsCVE-2021-420087.8The decode_data function in drivers/net/hamradio/6pack.c in the Linux kernel before 5.13.13 has a slab out-of-bounds write. Input from a proCVE-2021-420094.3An authenticated Apache Traffic Control Traffic Ops user with Portal-level privileges can send a request with a specially-crafted email subjCVE-2021-42019.8Missing access control in ForgeRock Access Management 7.1.0 and earlier versions on all platforms allows remote unauthenticated attackers toCVE-2021-420109.8Heron versions <= 0.20.4-incubating allows CRLF log injection because of the lack of escaping in the log statements. Please update to versio
CVE-2021-41992: Medium severity, CVSS 5.6 | Vulnix