by Kastro
Paper/Archive/CVE-2021-38611

CVE-2021-38611

mitre — A command-injection vulnerability in the Image Upload function of the NASCENT RemKon Device Manager 4.0.0.0 allows attackers to execute a…

EPSS 2%CVSS 9.8
critical.is priorityof 100
45
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 80.0.800 × 2016.0No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

A command-injection vulnerability in the Image Upload function of the NASCENT RemKon Device Manager 4.0.0.0 allows attackers to execute arbitrary commands, as root, via shell metacharacters in the filename parameter to assets/index.php.

Affected

ProductAffectedFixed inSource
n/an/a–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refnascent.com/single-post/2019/01/17/nascent-technology-releases-remkon-31-to-enhance-audio-experiencerefblacklanternsecurity.com/2021-08-23-Nascent-RemKon-CVEs