CVE-2021-21881

CRITICALNuclei

lantronix premierwave_2050_firmware Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Title source: VulnCheck
STIX 2.1 vulnerability

Record summary

CVE-2021-21881 has a selected CVSS score of 9.9 (critical); EIP currently links 1 Nuclei template.

Description

An OS command injection vulnerability exists in the Web Manager Wireless Network Scanner functionality of Lantronix PremierWave 2050 8.9.0.0R4. A specially-crafted HTTP request can lead to command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Aug 19, 2022 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Nuclei templates
1

Affected products and versions

2
ProductSourceVersion range

premierwave_2050_firmware

Browse lantronix / premierwave_2050_firmware
VulnCheckVersion data not supplied

Lantronix

CVE ListLantronix PremierWave 2050 8.9.0.0R4 (in QEMU)affected

Nuclei templates

1
ProjectDiscoveryCRITICALLantronix PremierWave 2050 8.9.0.0R4 - Remote Command InjectionCVSS 9.9

Lantronix PremierWave 2050 8.9.0.0R4 contains an OS command injection vulnerability. A specially-crafted HTTP request can lead to command in the Web Manager Wireless Network Scanner. An attacker can make an authenticated HTTP request to trigger this vulnerability.

Impact

Successful exploitation of this vulnerability could lead to unauthorized access, data leakage, or complete compromise of the affected device.

Remediation

Apply the latest firmware update provided by Lantronix to mitigate the vulnerability.

WeaknessesCWE-78
Authorsgy741
Template tagscve2021cvelantronixrceoastciscovkevvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CPE: cpe:2.3:o:lantronix:premierwave_2050_firmware:8.9.0.0:r4:*:*:*:*:*:*
https://talosintelligence.com/vulnerability_reports/TALOS-2021-1325 https://nvd.nist.gov/vuln/detail/CVE-2021-21881 https://github.com/ARPSyndicate/cvemon https://github.com/ARPSyndicate/kenzer-templates

Source: ProjectDiscovery

References

2