Lucene search

[email protected]CVE-2021-44132

HistoryFeb 25, 2022 - 8:15 p.m.

CVE-2021-44132

2022-02-2520:15:08

CWE-77

[email protected]

web.nvd.nist.gov

cve-2021-44132

c-data

onu4ferw

command injection

vulnerability

nvd

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

0.0005 Low

EPSS

Percentile

19.1%

JSON

A command injection vulnerability in the function formImportOMCIShell of C-DATA ONU4FERW V2.1.13_X139 allows attackers to execute arbitrary commands via a crafted file.

Affected configurations

NVD

Node

c-data_onu4ferw_projectc-data_onu4ferw_firmwareRange≤2.1.13_x139

AND

c-data_onu4ferw_projectc-data_onu4ferwMatch-

CPENameOperatorVersion
c-data_onu4ferw_project:c-data_onu4ferw_firmwarec-data onu4ferw project c-data onu4ferw firmwarele2.1.13_x139

CPE	Name	Operator	Version
c-data_onu4ferw_project:c-data_onu4ferw_firmware	c-data onu4ferw project c-data onu4ferw firmware	le	2.1.13_x139

References

exploitwriter.io/2022/02/25/os-command-injection-in-c-data-onu4ferw-cve-2021-44132/

exploitwriter.wordpress.com/2021/11/19/remote-code-execution-in-c-data-onu4ferw/

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

0.0005 Low

EPSS

Percentile

19.1%

JSON

Related for CVE-2021-44132

cnvd1 cvelist1 nvd1 prion1