by Kastro
Paper/Archive/CVE-2021-33527

CVE-2021-33527

MB connect line mbDIALUP — OS Command Injection in mbDIALUP <= 3.9R0.0

EPSS 5%CVSS 9.8
critical.is priorityof 100
48
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 91.5.915 × 2018.3No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

In MB connect line mbDIALUP versions <= 3.9R0.0 a remote attacker can send a specifically crafted HTTP request to the service running with NT AUTHORITY\SYSTEM that will not correctly validate the input. This can lead to an arbitrary code execution with the privileges of the service.

Affected

ProductAffectedFixed inSource
mbDIALUP3.9R0.0 – 3.9R0.0–CNA

Scores by source

CERTVDE (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refcert.vde.com/de-de/advisories/vde-2021-017