by Kastro
Paper/Archive/CVE-2021-21873

CVE-2021-21873

talos — A specially-crafted HTTP request can lead to arbitrary command execution in RSA keypasswd parameter.

EPSS 3%CVSS 9.1
critical.is priorityof 100
45
CVSS 9.1 (CNA, NVD agree)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 87.4.874 × 2017.5No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

A specially-crafted HTTP request can lead to arbitrary command execution in RSA keypasswd parameter. An attacker can make an authenticated HTTP request to trigger this vulnerability.

Affected

ProductAffectedFixed inSource
LantronixLantronix PremierWave 2050 8.9.0.0R4 (in QEMU)–CNA

Scores by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
talos (CNA)9.1CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

References

reftalosintelligence.com/vulnerability_reports/TALOS-2021-1314