by Kastro
Paper/Archive/CVE-2021-21875

CVE-2021-21875

talos — A specially-crafted HTTP request can lead to arbitrary command execution in EC keypasswd parameter.

EPSS 3%CVSS 9.1
critical.is priorityof 100
45
CVSS 9.1 (CNA, NVD agree)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 87.4.874 × 2017.5No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

A specially-crafted HTTP request can lead to arbitrary command execution in EC keypasswd parameter. An attacker can make an authenticated HTTP request to trigger this vulnerability.

Affected

ProductAffectedFixed inSource
LantronixLantronix PremierWave 2050 8.9.0.0R4 (in QEMU)–CNA

Scores by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
talos (CNA)9.1CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

References

reftalosintelligence.com/vulnerability_reports/TALOS-2021-1314