Lucene search

[email protected]CVE-2021-21881

HistoryDec 22, 2021 - 7:15 p.m.

CVE-2021-21881

2021-12-2219:15:09

CWE-78

[email protected]

web.nvd.nist.gov

In Wild

cve-2021-21881

os command injection

web manager wireless network scanner

lantronix

premierwave 2050 8.9.0.0r4

nvd

9.9 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

9.5 High

AI Score

Confidence

High

9 High

CVSS2

Access Vector

Access Complexity

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

0.971 High

EPSS

Percentile

99.8%

JSON

An OS command injection vulnerability exists in the Web Manager Wireless Network Scanner functionality of Lantronix PremierWave 2050 8.9.0.0R4. A specially-crafted HTTP request can lead to command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.

Affected configurations

Vulners

NVD

Node

lantronixsecurelinxRange≤(

VendorProductVersionCPE
lantronixsecurelinx*cpe:2.3:h:lantronix:securelinx:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
lantronix	securelinx	*	cpe:2.3:h:lantronix:securelinx::::::::

CNA Affected

[
  {
    "product": "Lantronix",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Lantronix PremierWave 2050 8.9.0.0R4 (in QEMU)"
      }
    ]
  }
]