CVE-2021-37912

CRITICAL

HGiga OAKlouds Portal 2.0-<2.0-2 - Unauthenticated OS Command Injection via Ethernet Number Parameter

Title source: llm

Description

The HGiga OAKlouds mobile portal does not filter special characters of the Ethernet number parameter of the network interface card setting page. Remote attackers can use this vulnerability to perform command injection and execute arbitrary commands in the system without logging in.

References (1)

Core 1

Core References

Third Party Advisory x_refsource_misc

https://www.twcert.org.tw/tw/cp-132-5091-7e0c5-1.html

Scores

CVSS v3 9.8

EPSS 0.0283

EPSS Percentile 84.9%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-78

Status published

Products (1)

hgiga/oaklouds_portal 2.0 - 2.0-2

Published Sep 15, 2021

Tracked Since Feb 18, 2026