CVE-2020-21991
9.8
CRITICAL · CVSS 3.1 · EPSS 2.9% (pctl 87)
In your normal cycle
Critical by CVSS (9.8), but no sign of active exploitation.
Description
AVE DOMINAplus <=1.10.x suffers from an authentication bypass vulnerability due to missing control check when directly calling the autologin GET parameter in changeparams.php script. Setting the autologin value to 1 allows an unauthenticated attacker to permanently disable the authentication security control and access the management interface with admin privileges without providing credentials.
Scoring
| CVSS | 9.8 (CRITICAL, v3.1) |
|---|---|
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | 2.91% — more likely to be exploited than 87% of all CVEs |
| Weakness | CWE-287 |
| On CISA KEV | no |
| Public exploit | none known |
| Published | 2021-04-28 |
| Last modified | 2026-06-17 |
Affected (13)
| Vendor | Product |
|---|---|
| ave | 53ab-wbs |
| ave | 53ab-wbs firmware |
| ave | dominaplus |
| ave | ts01 |
| ave | ts01 firmware |
| ave | ts03x-v |
| ave | ts03x-v firmware |
| ave | ts04x-v |
| ave | ts04x-v firmware |
| ave | ts05 |
| ave | ts05 firmware |
| ave | ts05n-v |
| ave | ts05n-v firmware |
References
→ the Explorer · watch your stack · NVD