CVE-2021-25812

CRITICAL

China Mobile An Lianbao WF-1 Firmware 1.01 - OS Command Injection via 'ip' Parameter

Title source: llm

Command injection vulnerability in China Mobile An Lianbao WF-1 1.01 via the 'ip' parameter with a POST request to /api/ZRQos/set_online_client.

Core 3

Core References

Third Party Advisory x_refsource_misc

Product x_refsource_misc

Third Party Advisory x_refsource_misc

CVSS v3 9.8

EPSS 0.0281

EPSS Percentile 84.7%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-77

Status published

Products (1)

chinamobile/an_lianbao_wf-1_firmware 1.0.1

Published Apr 29, 2021

Tracked Since Feb 18, 2026