Lucene search

[email protected]CVE-2021-38485

HistoryOct 22, 2021 - 2:15 p.m.

CVE-2021-38485

2021-10-2214:15:08

CWE-20

[email protected]

web.nvd.nist.gov

cve

2021

38485

improper input validation

file replacement

nvd

6.5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8.5 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

40.5%

JSON

The affected product is vulnerable to improper input validation in the restore file. This enables an attacker to provide malicious config files to replace any file on disk.

Affected configurations

NVD

Node

emersonwireless_1410_gateway_firmwareRange<4.7.94

AND

emersonwireless_1410_gateway

Node

emersonwireless_1410d_gateway_firmwareRange<4.7.94

AND

emersonwireless_1410d_gateway

Node

emersonwireless_1420_gateway_firmwareRange<4.7.94

AND

emersonwireless_1420_gatewayMatch-

CPENameOperatorVersion
emerson:wireless_1410_gateway_firmwareemerson wireless 1410 gateway firmwarelt4.7.94

CPE	Name	Operator	Version
emerson:wireless_1410_gateway_firmware	emerson wireless 1410 gateway firmware	lt	4.7.94

CNA Affected

[
  {
    "product": "WirelessHART Gateway",
    "vendor": "Emerson",
    "versions": [
      {
        "lessThanOrEqual": "4.7.94",
        "status": "affected",
        "version": "1410",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "4.7.94",
        "status": "affected",
        "version": "1410D",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "4.7.94",
        "status": "affected",
        "version": "1420",
        "versionType": "custom"
      }
    ]
  }
]

References

us-cert.cisa.gov/ics/advisories/icsa-21-278-02

6.5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8.5 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

40.5%

JSON

Related for CVE-2021-38485

nvd1 prion1 cvelist1 ics1