CVE-2021-31245

Name: CVE-2021-31245
Creator: NVD / NIST
Published: 2021-05-06T13:15:12.607+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

MEDIUMCVSS 5.9/10EPSS 2.09%

Last modified Jun 17, 2026

CVE-2021-31245 is a medium-severity vulnerability rated 5.9/10 on the CVSS scale. omr-admin.py in openmptcprouter-vps-admin 0.57.3 and earlier compares the user provided password with the original password in a length dependent manner, which allows remote attackers to guess the password via a timing attack.. EPSS estimates a 2.09% chance of exploitation in the next 30 days.

Description

omr-admin.py in openmptcprouter-vps-admin 0.57.3 and earlier compares the user provided password with the original password in a length dependent manner, which allows remote attackers to guess the password via a timing attack.

Metrics

CVSS 3.1

5.9/10

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS Probability

2.09%

79.2th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-287

Affected Software

Vendor	Product	Versions
Openmptcprouter	Openmptcprouter	<= 0.57.3

References

https://github.com/Ysurac/openmptcprouter-vps-adminThird Party Advisory
https://github.com/Ysurac/openmptcprouter-vps-admin/commit/a01cbc8c3d3b8bb7720bf3ff234671b4c0e1859c#diff-b89ee68e63302a732d4bde35eb04a205b06f1611147e139642356f173195ab80Patch, Third Party Advisory
https://medium.com/d3crypt/timing-attack-on-openmptcprouter-vps-admin-authentication-cve-2021-31245-12dd92303e1Exploit, Patch, Third Party Advisory
https://www.openmptcprouter.com/Vendor Advisory
https://github.com/Ysurac/openmptcprouter-vps-adminThird Party Advisory
https://github.com/Ysurac/openmptcprouter-vps-admin/commit/a01cbc8c3d3b8bb7720bf3ff234671b4c0e1859c#diff-b89ee68e63302a732d4bde35eb04a205b06f1611147e139642356f173195ab80Patch, Third Party Advisory
https://medium.com/d3crypt/timing-attack-on-openmptcprouter-vps-admin-authentication-cve-2021-31245-12dd92303e1Exploit, Patch, Third Party Advisory
https://www.openmptcprouter.com/Vendor Advisory

Timeline

Published: May 6, 2021
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2021-31245?

How severe is CVE-2021-31245?

CVE-2021-31245 has a CVSS score of 5.9/10 (MEDIUM severity). The EPSS model estimates a 2.09% probability of exploitation in the next 30 days.

How do I fix CVE-2021-31245?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2021-31245?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST