What’s Vulnerable › Vulnerabilities

CVE-2021-29012

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 3.2% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-04-02 · updated 2026-06-17
• Weakness: CWE-287

Description

DMA Softlab Radius Manager 4.4.0 assigns the same session cookie to every admin session. The cookie is valid when the admin is logged in, but is invalid (temporarily) during times when the admin is logged out. In other words, the cookie is functionally equivalent to a static password, and thus provides permanent access if stolen.

Affected products

• Dmasoftlab Dma Radius Manager: 4.4.0

References

• http://packetstormsecurity.com/files/164154/DMA-Softlab-Radius-Manager-4.4.0-Session-Management-Cross-Site-Scripting.html
• https://github.com/1d8/publications/tree/main/cve-2021-29012
• https://sourceforge.net/projects/radiusmanager/
• http://packetstormsecurity.com/files/164154/DMA-Softlab-Radius-Manager-4.4.0-Session-Management-Cross-Site-Scripting.html
• https://github.com/1d8/publications/tree/main/cve-2021-29012
• https://sourceforge.net/projects/radiusmanager/

Get alerted when CVE-2021-29012 or the next vulnerability affects your stack