What’s Vulnerable › Vulnerabilities
CVE-2021-28909
- Severity: critical (CVSS 9.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 1.4% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2021-09-09 · updated 2026-06-17
- Weakness: CWE-307
Description
BAB TECHNOLOGIE GmbH eibPort V3 prior version 3.9.1 allow unauthenticated attackers to access uncontrolled the login service at /webif/SecurityModule in a brute force attack. The password could be weak and default username is known as 'admin'. This is usable and part of an attack chain to gain SSH root access.
Affected products
- Bab-Technologie Eibport Firmware: before 3.9.1 — fixed in 3.9.1
How to fix
Upgrade to a fixed version: Bab-Technologie Eibport Firmware 3.9.1. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2021-28909 or the next vulnerability affects your stack