Lucene search

TalosCVELIST:CVE-2021-40413

HistoryJan 28, 2022 - 7:10 p.m.

CVE-2021-40413

2022-01-2819:10:10

CWE-284

talos

www.cve.org

cve-2021-40413

cgiserver.cgi

firmware upgrade

http request vulnerability

CVSS3

7.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

AI Score

7.5

Confidence

High

EPSS

0.001

Percentile

31.9%

JSON

An incorrect default permission vulnerability exists in the cgiserver.cgi cgi_check_ability functionality of reolink RLC-410W v3.0.0.136_20121102. The UpgradePrepare is the API that checks if a provided filename identifies a new version of the RLC-410W firmware. If the version is new, it would be possible, allegedly, to later on perform the Upgrade. An attacker can send an HTTP request to trigger this vulnerability.

References

talosintelligence.com/vulnerability_reports/TALOS-2021-1425

CVSS3

7.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

AI Score

7.5

Confidence

High

EPSS

0.001

Percentile

31.9%

JSON

Related for CVELIST:CVE-2021-40413