Lucene search

MitreCVE-2021-26747

HistoryFeb 18, 2021 - 9:15 p.m.

CVE-2021-26747

2021-02-1821:15:11

CWE-78

mitre

web.nvd.nist.gov

cve-2021-26747

netis wf2780

netis wf2411

shell metacharacter injection

remote code execution

nvd

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.9

Confidence

High

EPSS

0.01

Percentile

83.3%

JSON

Netis WF2780 2.3.40404 and WF2411 1.1.29629 devices allow Shell Metacharacter Injection into the ping command, leading to remote code execution.

Affected configurations

Nvd

Node

netis-systemswf2780_firmwareMatch2.3.40404

AND

netis-systemswf2780Match-

Node

netis-systemswf2411_firmwareMatch1.1.29629

AND

netis-systemswf2411Match-

VendorProductVersionCPE
netis-systemswf2780_firmware2.3.40404cpe:2.3:o:netis-systems:wf2780_firmware:2.3.40404:*:*:*:*:*:*:*
netis-systemswf2780-cpe:2.3:h:netis-systems:wf2780:-:*:*:*:*:*:*:*
netis-systemswf2411_firmware1.1.29629cpe:2.3:o:netis-systems:wf2411_firmware:1.1.29629:*:*:*:*:*:*:*
netis-systemswf2411-cpe:2.3:h:netis-systems:wf2411:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
netis-systems	wf2780_firmware	2.3.40404	cpe:2.3:o:netis-systems:wf2780_firmware:2.3.40404:::::::*
netis-systems	wf2780	-	cpe:2.3:h:netis-systems:wf2780:-:::::::*
netis-systems	wf2411_firmware	1.1.29629	cpe:2.3:o:netis-systems:wf2411_firmware:1.1.29629:::::::*
netis-systems	wf2411	-	cpe:2.3:h:netis-systems:wf2411:-:::::::*

References

www.netis-systems.com.tw/

github.com/yhstar00/netis-route

Social References

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.9

Confidence

High

EPSS

0.01

Percentile

83.3%

JSON

Related for CVE-2021-26747