CVE-2021-32753

CVE-2021-32753 affects EdgeX Foundry versions Edinburgh, Fuji, Geneva, and Hanoi, allowing a remote attacker to gain unauthorized access. The vulnerability arises when the API gateway uses OAuth2 authentication and a proxy user is created, as the client_id and client_secret are set to the proxy user's username. This enables a dictionary-based password attack against the OAuth2 token endpoint, leading to the compromise of authentication tokens and subsequent unauthorized access to EdgeX microservices. With a CVSS score of 6.5 (Medium), this vulnerability has a network attack vector, low attack complexity, and can result in partial loss of confidentiality and integrity. There is currently no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.