CVE-2021-21885
📋 TL;DR
This CVE describes an authenticated directory traversal vulnerability in Lantronix PremierWave 2050's Web Manager FsMove functionality. An attacker with valid credentials can craft HTTP requests to access arbitrary files on the system. This affects organizations using vulnerable versions of the PremierWave 2050 device.
💻 Affected Systems
- Lantronix PremierWave 2050
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through local file inclusion leading to credential theft, configuration exposure, and potential remote code execution.
Likely Case
Unauthorized access to sensitive files including configuration files, logs, and credentials stored on the device.
If Mitigated
Limited impact if proper network segmentation and authentication controls prevent unauthorized access to the web interface.
🎯 Exploit Status
Exploitation requires valid credentials but the directory traversal technique is straightforward once authenticated.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Lantronix security advisory for specific patched version
Vendor Advisory: https://www.lantronix.com/support/security-advisories/
Restart Required: Yes
Instructions:
1. Check Lantronix security advisory for latest firmware. 2. Download appropriate firmware update. 3. Apply firmware update via Web Manager or console. 4. Reboot device to complete installation.
🔧 Temporary Workarounds
Restrict Web Manager Access
allLimit access to the Web Manager interface to trusted IP addresses only
Configure firewall rules to restrict access to port 80/443 on the device
Disable Unused Accounts
allRemove or disable any unnecessary user accounts with Web Manager access
Review and disable unused accounts in Web Manager user management
🧯 If You Can't Patch
- Implement strict network segmentation to isolate PremierWave devices from untrusted networks
- Enforce strong authentication policies and regularly rotate credentials for Web Manager access
🔍 How to Verify
Check if Vulnerable:
Check firmware version in Web Manager under System Information. If version is 8.9.0.0R4, device is vulnerable.Check Version:
Login to Web Manager and navigate to System > Information to view firmware versionVerify Fix Applied:
Verify firmware version has been updated to a version beyond 8.9.0.0R4 as specified in Lantronix advisory.📡 Detection & Monitoring
Log Indicators:
- Unusual file access patterns in Web Manager logs
- Multiple failed authentication attempts followed by successful login and file operations
Network Indicators:
- HTTP requests to FsMove endpoint with directory traversal patterns (../ sequences)
- Unusual file access from Web Manager interface
SIEM Query:
source="premierwave_logs" AND (uri="*FsMove*" AND (uri="*../*" OR uri="*..\\*"))