PatchTheCVE: iac-ast2500a firmwarehttps://patchthecve.com/CVEs with upgrade or downgrade fix stepsCVE-2021-46279: Session fixation and insufficient session expiration vulnerabilities allow an attacker to perfom session hijachttps://patchthecve.com/cve/CVE-2021-46279.htmlhttps://patchthecve.com/cve/CVE-2021-46279.htmlWed, 17 Jun 2026 04:14:42 +0000MEDIUM 5.8: Session fixation and insufficient session expiration vulnerabilities allow an attacker to perfom session hijacking attacks against users. This issue affects: Lanner Inc IAC-AST2500A standard firmware version 1.10.0.CVE-2021-45925: Observable discrepancies in the login process allow an attacker to guess legitimate user names registered in thttps://patchthecve.com/cve/CVE-2021-45925.htmlhttps://patchthecve.com/cve/CVE-2021-45925.htmlWed, 17 Jun 2026 04:14:15 +0000MEDIUM 5.3: Observable discrepancies in the login process allow an attacker to guess legitimate user names registered in the BMC. This issue affects: Lanner Inc IAC-AST2500A standard firmware version 1.10.0.CVE-2021-44776: A broken access control vulnerability in the SubNet_handler_func function of spx_restservice allows an attackehttps://patchthecve.com/cve/CVE-2021-44776.htmlhttps://patchthecve.com/cve/CVE-2021-44776.htmlWed, 17 Jun 2026 04:12:50 +0000MEDIUM 6.5: A broken access control vulnerability in the SubNet_handler_func function of spx_restservice allows an attacker to arbitrarily change the security access rights to KVM and Virtual Media functionalities. This issue affects: Lanner Inc IAC-AST2500A standard firmware version 1.10.0.CVE-2021-44769: An improper input validation vulnerability in the TLS certificate generation function allows an attacker to cahttps://patchthecve.com/cve/CVE-2021-44769.htmlhttps://patchthecve.com/cve/CVE-2021-44769.htmlWed, 17 Jun 2026 04:12:50 +0000MEDIUM 4.9: An improper input validation vulnerability in the TLS certificate generation function allows an attacker to cause a Denial-of-Service (DoS) condition which can only be reverted via a factory reset. This issue affects: Lanner Inc IAC-AST2500A standard firmware version 1.10.0.CVE-2021-44467: A broken access control vulnerability in the KillDupUsr_func function of spx_restservice allows an attacker tohttps://patchthecve.com/cve/CVE-2021-44467.htmlhttps://patchthecve.com/cve/CVE-2021-44467.htmlWed, 17 Jun 2026 04:12:23 +0000MEDIUM 5.3: A broken access control vulnerability in the KillDupUsr_func function of spx_restservice allows an attacker to arbitrarily terminate active sessions of other users, causing a Denial-of-Service (DoS) condition, if an input parameter is correctly guessed. This issue affects: Lanner Inc IAC-AST2500A stCVE-2021-26733: A broken access control vulnerability in the FirstReset_handler_func function of spx_restservice allows an atthttps://patchthecve.com/cve/CVE-2021-26733.htmlhttps://patchthecve.com/cve/CVE-2021-26733.htmlWed, 17 Jun 2026 03:43:44 +0000MEDIUM 5.3: A broken access control vulnerability in the FirstReset_handler_func function of spx_restservice allows an attacker to arbitrarily send reboot commands to the BMC, causing a Denial-of-Service (DoS) condition. This issue affects: Lanner Inc IAC-AST2500A standard firmware version 1.10.0.CVE-2021-26732: A broken access control vulnerability in the First_network_func function of spx_restservice allows an attackerhttps://patchthecve.com/cve/CVE-2021-26732.htmlhttps://patchthecve.com/cve/CVE-2021-26732.htmlWed, 17 Jun 2026 03:43:44 +0000MEDIUM 6.5: A broken access control vulnerability in the First_network_func function of spx_restservice allows an attacker to arbitrarily change the network configuration of the BMC. This issue affects: Lanner Inc IAC-AST2500A standard firmware version 1.10.0.CVE-2021-26731: Command injection and multiple stack-based buffer overflows vulnerabilities in the modifyUserb_func function ohttps://patchthecve.com/cve/CVE-2021-26731.htmlhttps://patchthecve.com/cve/CVE-2021-26731.htmlWed, 17 Jun 2026 03:43:44 +0000CRITICAL 9.1: Command injection and multiple stack-based buffer overflows vulnerabilities in the modifyUserb_func function of spx_restservice allow an authenticated attacker to execute arbitrary code with the same privileges as the server user (root). This issue affects: Lanner Inc IAC-AST2500A standard firmware CVE-2021-26730: A stack-based buffer overflow vulnerability in a subfunction of the Login_handler_func function of spx_restserhttps://patchthecve.com/cve/CVE-2021-26730.htmlhttps://patchthecve.com/cve/CVE-2021-26730.htmlWed, 17 Jun 2026 03:43:44 +0000CRITICAL 10.0: A stack-based buffer overflow vulnerability in a subfunction of the Login_handler_func function of spx_restservice allows an attacker to execute arbitrary code with the same privileges as the server user (root). This issue affects: Lanner Inc IAC-AST2500A standard firmware version 1.10.0.CVE-2021-26729: Command injection and multiple stack-based buffer overflows vulnerabilities in the Login_handler_func functionhttps://patchthecve.com/cve/CVE-2021-26729.htmlhttps://patchthecve.com/cve/CVE-2021-26729.htmlWed, 17 Jun 2026 03:43:44 +0000CRITICAL 10.0: Command injection and multiple stack-based buffer overflows vulnerabilities in the Login_handler_func function of spx_restservice allow an attacker to execute arbitrary code with the same privileges as the server user (root). This issue affects: Lanner Inc IAC-AST2500A standard firmware version 1.10CVE-2021-26728: Command injection and stack-based buffer overflow vulnerabilities in the KillDupUsr_func function of spx_restshttps://patchthecve.com/cve/CVE-2021-26728.htmlhttps://patchthecve.com/cve/CVE-2021-26728.htmlWed, 17 Jun 2026 03:43:44 +0000CRITICAL 10.0: Command injection and stack-based buffer overflow vulnerabilities in the KillDupUsr_func function of spx_restservice allow an attacker to execute arbitrary code with the same privileges as the server user (root). This issue affects: Lanner Inc IAC-AST2500A standard firmware version 1.10.0.CVE-2021-26727: Multiple command injections and stack-based buffer overflows vulnerabilities in the SubNet_handler_func functihttps://patchthecve.com/cve/CVE-2021-26727.htmlhttps://patchthecve.com/cve/CVE-2021-26727.htmlWed, 17 Jun 2026 03:43:44 +0000CRITICAL 10.0: Multiple command injections and stack-based buffer overflows vulnerabilities in the SubNet_handler_func function of spx_restservice allow an attacker to execute arbitrary code with the same privileges as the server user (root). This issue affects: Lanner Inc IAC-AST2500A standard firmware version 1.