Threat Investigation
Request a demo

CVE-2021-40067

Medium

Description

The access controls on the Mobility read-write API improperly validate user access permissions; this API is disabled by default. If the API is manually enabled, attackers with both network access to the API and valid credentials can read and write data to it; regardless of access control group membership settings. This vulnerability is fixed in Mobility v12.14.

SeverityMedium
CVSS6.8
Exploit probability—
ProductNetmotionsoftware Mobility
PublishedSep 16, 2021
First seenSep 16, 2021

How to fix

Update
  • netmotionsoftware mobility12.14 or later

Affected products

ProductAffected versionsFixed in
netmotionsoftware mobilityv < 12.1412.14

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.