CVE-2021-40856

mediumpriority · attend · 48EPSS 0.501 · 99 %ileEUUS

grimoire priorityP1 · Urgent

Exploitable?

—

no known exploitation

Likely / severe?

50.1% (99th) EPSS

CVSS 5 · medium

Is it mine?

4 products

Who says so?

3 sources

cnnvd · enisa_euvd · nvd

EPSS · scored 2026-10-23

Auerswald COMfortel 1400 IP and 2600 IP before 2.8G devices allow Authentication Bypass via the /about/../ substring.

cvss

Technical severity, 0–10. One row per scoring source.

7.5

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 5–7.5

v2.05mediumAV:N/AC:L/Au:N/C:P/I:N/A:Nprimary · NVD / NIST USexploitability 10 · impact 2.9

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:Nprimary · NVD / NIST USexploitability 3.9 · impact 3.6

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:Hsecondary · CVSS-BT (t0sche)

The CWE weakness classes this flaw belongs to.

Products and version ranges known to be affected.

n/a n/a≤ n/aenisa_euvdEU
auerswald comfortel 1400 ip firmware≤ 2.8fnvdUScpe:2.3:o:auerswald:comfortel_1400_ip_firmware:*:*:*:*:*:*:*:*
auerswald comfortel 2600 ip firmware≤ 2.8fnvdUScpe:2.3:o:auerswald:comfortel_2600_ip_firmware:*:*:*:*:*:*:*:*
auerswald comfortel 3600 ip firmware≤ 2.8fnvdUScpe:2.3:o:auerswald:comfortel_3600_ip_firmware:*:*:*:*:*:*:*:*

Other names and identifiers for this entity.

Which sources assert this record, and when.

published 2021-12-13modified 2026-06-17

Related entries.

ID	severity	EPSS	exploitable	published
CVE-2025-24813US	critical9.8OT critical	99.9% (100th)	KEV	2025-03-10
Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Defau…
CVE-2021-40539US	critical9.8OT critical	99.0% (100th)	KEV	2021-09-07
Zoho ManageEngine ADSelfService Plus version 6113 and prior is vulnerable to REST API authentication bypass with resultant remote code execution.
CVE-2020-15505US	critical9.8OT critical	99.7% (100th)	KEV	2020-07-07
A remote code execution vulnerability in MobileIron Core & Connector versions 10.3.0.3 and earlier, 10.4.0.0, 10.4.0.1, 10.4.0.2, 10.4.0.3, 10.5.1.0, 10.5.2.0 and 10.6.0.0; and Sen…
CVE-2019-0571US	high7.8	15.8% (97th)	Exploit	2019-01-08
An elevation of privilege vulnerability exists when the Windows Data Sharing Service improperly handles file operations, aka "Windows Data Sharing Service Elevation of Privilege Vu…
CVE-2026-67602US	critical9.1	0.64% (50th)	Exploit	2026-08-24
phpIPAM before 1.8.2 contains an authentication bypass vulnerability in the REST API that allows unauthenticated attackers to gain full API access by exploiting an insecure object…

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.