by Kastro
Paper/Archive/CVE-2021-45876

CVE-2021-45876

mitre — Multiple versions of GARO Wallbox GLB/GTB/GTC are affected by unauthenticated command injection.

EPSS 1%CVSS 9.8
critical.is priorityof 100
44
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 74.0.740 × 2014.8No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

Multiple versions of GARO Wallbox GLB/GTB/GTC are affected by unauthenticated command injection. The url parameter of the function module downloadAndUpdate is vulnerable to an command Injection. Unfiltered user input is used to generate code which then gets executed when downloading new firmware.

Affected

ProductAffectedFixed inSource
n/an/a–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refgithub.com/delikely/advisory/tree/main/GARO