CVE-2021-4029

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)

Published: Feb 24, 2022 / Updated: 33mo ago

010
CVSS 8.8EPSS 0.05%High
CVE info copied to clipboard

A command injection vulnerability in the CGI program of the Zyxel ARMOR Z1/Z2 firmware could allow an attacker to execute arbitrary OS commands via a LAN interface.

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Timeline

First Article

Feedly found the first article mentioning CVE-2021-4029. See article

Feb 22, 2022 at 3:34 PM / github.com
EPSS

EPSS Score was set to: 0.05% (Percentile: 17.7%)

Sep 17, 2023 at 6:43 AM
Static CVE Timeline Graph

Affected Systems

Zyxel/nbg6816_firmware
+null more

Patches

www.zyxel.com
+null more

Attack Patterns

CAPEC-108: Command Line Execution through SQL Injection
+null more

References

Vulnerability Summary for the Week of February 21, 2022
Original release date: February 28, 2022 Last revised: March 1, 2022 High Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info airspan -- mimosa_management_platform MMP: All versions prior to v1.0.3, PTP C-series: Device versions prior to v2.8.6.1, and PTMP C-series and A5x: Device versions prior to v2.5.4.1 does not perform proper authorization checks on multiple API functions. An attacker may gain access to these functions and achieve remote code execution, create a denial-of-service condition, and obtain sensitive information. 2022-02-18 10 CVE-2022-21141 MISC airspan -- mimosa_management_platform MMP: All versions prior to v1.0.3, PTP C-series:

News

Security Bulletin 9 Mar 2022 | #macos | #macsecurity
CVE Number Description Base Score Reference CVE-2020-15824 In JetBrains Kotlin from 1.4-M1 to 1.4-RC (as Kotlin 1.3.7x is not affected by the issue. Fixed version is 1.4.0) there is a script-cache privilege escalation vulnerability due to kotlin-main-kts cached scripts in the system temp directory, which is shared by all users... The post Security Bulletin 9 Mar 2022 #macos #macsecurity appeared first on NATIONAL CYBER SECURITY NEWS TODAY .
Security Bulletin 2 Mar 2022 - Cyber Security Agency of Singapore
Security Bulletin 2 Mar 2022 Cyber Security Agency of Singapore
Security Bulletin 9 Mar 2022 - Cyber Security Agency of Singapore
Security Bulletin 9 Mar 2022 Cyber Security Agency of Singapore
Security Bulletin 2 Mar 2022 - Cyber Security Agency of Singapore
Security Bulletin 2 Mar 2022 Cyber Security Agency of Singapore
US-CERT Bulletin (SB22-059):Vulnerability Summary for the Week of February 21, 2022
The CISA Vulnerability Bulletin provides a summary of new vulnerabilities that have been recorded by the National Institute of Standards and Technology (NIST) National Vulnerability Database (NVD) in the past week. NVD is sponsored by CISA. In some cases, the vulnerabilities in the bulletin may not yet have assigned CVSS scores. Please visit NVD for updated vulnerability entries, which include CVSS scores once they are available. Vulnerabilities are based on the Common Vulnerabilities and Exposures (CVE) vulnerability naming standard and are organized according to severity, determined by the Common Vulnerability Scoring System (CVSS) standard. The division of high, medium, and low severities correspond to the following scores: High : vulnerabilities with a CVSS base score of 7.0–10.0 Medium : vulnerabilities with a CVSS base score of 4.0–6.9 Low : vulnerabilities with a CVSS base score of 0.0–3.9 Entries may include additional information provided by organizations and efforts sponsored by CISA.
See 13 more articles and social media posts

CVSS V3.1

Attack Vector:Adjacent_network
Attack Complexity:Low
Privileges Required:None
User Interaction:None
Scope:Unchanged
Confidentiality:High
Integrity:High
Availability Impact:High

Categories

Be the first to know about critical vulnerabilities

Collect, analyze, and share vulnerability reports faster using AI