by Kastro
Paper/Archive/CVE-2021-21874

CVE-2021-21874

talos — A specially-crafted HTTP request can lead to arbitrary command execution in DSA keypasswd parameter.

EPSS 3%CVSS 9.1
critical.is priorityof 100
45
CVSS 9.1 (CNA, NVD agree)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 87.4.874 × 2017.5No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

A specially-crafted HTTP request can lead to arbitrary command execution in DSA keypasswd parameter. An attacker can make an authenticated HTTP request to trigger this vulnerability.

Affected

ProductAffectedFixed inSource
LantronixLantronix PremierWave 2050 8.9.0.0R4 (in QEMU)–CNA

Scores by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
talos (CNA)9.1CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

References

reftalosintelligence.com/vulnerability_reports/TALOS-2021-1314