CVE-2021-25681

EPSS 10.8%

Vexday Risk Score

28Low

SSVC decision (CISA)

Attend

PoC available → attend closely

Exploit maturity

Proof of concept

Public proof of concept exists, but not yet automated.

CVSS —EPSS 10.8%KEV nãoPoC públicaNuclei —Metasploit —Patch —

Lifecycle

20 Apr 2021Published on NVD

21 Apr 2021Public PoC

Weaponization speed

1 daysto first PoC

Weaponized quickly — attackers prioritized this vulnerability. Patch urgently.

Recommendation: Plan a near-term fix — a public PoC already exists.

AdTran Personal Phone Manager 10.8.1 software is vulnerable to an issue that allows for exfiltration of data over DNS. This could allow for exposed AdTran Personal Phone Manager web servers to be used as DNS redirectors to tunnel arbitrary data over DNS. NOTE: The affected appliances NetVanta 7060 and NetVanta 7100 are considered End of Life and as such this issue will not be patched.

Affected products

n/a · n/a

public PoCs found — 2

cve_referencepacketstormsecurity.com/files/162280/Adtran-Personal-Phone-Manager-10.8.1-DNS-Exfiltration.htmlunverified exploitdbwww.exploit-db.com/exploits/49787unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://packetstormsecurity.com/files/162280/Adtran-Personal-Phone-Manager-10.8.1-DNS-Exfiltration.html https://github.com/3ndG4me/AdTran-Personal-Phone-Manager-Vulns/blob/main/CVE-2021-25681.md