Lucene search

[email protected]NVD:CVE-2021-38703

HistorySep 01, 2021 - 12:15 p.m.

CVE-2021-38703

2021-09-0112:15:07

[email protected]

web.nvd.nist.gov

wireless devices

arcadyan-derived firmware

remote code execution

syslog configuration

cve-2021-20090

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

0.972

Percentile

99.9%

JSON

Wireless devices running certain Arcadyan-derived firmware (such as KPN Experia WiFi 1.00.15) do not properly sanitise user input to the syslog configuration form. An authenticated remote attacker could leverage this to alter the device configuration and achieve remote code execution. This can be exploited in conjunction with CVE-2021-20090.

Affected configurations

Nvd

Node

kpnexperia_wifi_firmwareMatch1.00.15

AND

kpnexperia_wifiMatch-

VendorProductVersionCPE
kpnexperia_wifi_firmware1.00.15cpe:2.3:o:kpn:experia_wifi_firmware:1.00.15:*:*:*:*:*:*:*
kpnexperia_wifi-cpe:2.3:h:kpn:experia_wifi:-:*:*:*:*:*:*:*