Lucene search

TwcertCVELIST:CVE-2021-37913

HistorySep 15, 2021 - 7:10 p.m.

CVE-2021-37913 HGiga OAKlouds - Command Injection-2

2021-09-1519:10:25

CWE-78

twcert

www.cve.org

cve-2021-37913

hgiga oaklouds

command injection

remote attackers

ipv6 gateway

network interface card

arbitrary commands

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

Confidence

High

EPSS

0.004

Percentile

72.6%

JSON

The HGiga OAKlouds mobile portal does not filter special characters of the IPv6 Gateway parameter of the network interface card setting page. Remote attackers can use this vulnerability to perform command injection and execute arbitrary commands in the system without logging in.

CNA Affected

[
  {
    "product": "OAKlouds OAKSv2",
    "vendor": "HGiga",
    "versions": [
      {
        "lessThanOrEqual": "OAKlouds-network-2.0-2",
        "status": "affected",
        "version": "OAKlouds-network 2.0",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "OAKlouds OAKSv3",
    "vendor": "HGiga",
    "versions": [
      {
        "lessThanOrEqual": "OAKlouds-network-3.0-2",
        "status": "affected",
        "version": "OAKlouds-network 3.0",
        "versionType": "custom"
      }
    ]
  }
]

References

www.twcert.org.tw/tw/cp-132-5092-f88e2-1.html

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

Confidence

High

EPSS

0.004

Percentile

72.6%

JSON

Related for CVELIST:CVE-2021-37913