CVE-2021-40376

Name of the Vulnerable Software and Affected Versions otris Update Manager version 1.2.1.0

Description The issue allows local users to gain SYSTEM access through unauthenticated calls to exposed interfaces over a .NET named pipe. It is also possible that a remote attack could be conducted by leveraging WsHTTPBinding for HTTP traffic on TCP port 9000.

Recommendations For otris Update Manager version 1.2.1.0, consider restricting access to the exposed interfaces over the .NET named pipe and limiting HTTP traffic on TCP port 9000 to prevent potential exploitation. As a temporary workaround, restrict access to the WsHTTPBinding interface until a patch is available.