Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

nvd логотип

CVE-2021-33728

Опубликовано: 12 окт. 2021
Источник: nvd
CVSS3: 7.2
CVSS2: 9
EPSS Низкий

Описание

A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1). The affected system allows to upload JSON objects that are deserialized to JAVA objects. Due to insecure deserialization of user-supplied content by the affected software, a privileged attacker could exploit this vulnerability by sending a crafted serialized Java object. An exploit could allow the attacker to execute arbitrary code on the device with root privileges.

Ссылки

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:siemens:sinec_nms:*:*:*:*:*:*:*:*
Версия до 1.0 (исключая)
cpe:2.3:a:siemens:sinec_nms:1.0:-:*:*:*:*:*:*
cpe:2.3:a:siemens:sinec_nms:1.0:sp1:*:*:*:*:*:*
cpe:2.3:a:siemens:sinec_nms:1.0:sp2:*:*:*:*:*:*

EPSS

Процентиль: 83%
0.01993
Низкий

7.2 High

CVSS3

9 Critical

CVSS2

Дефекты

CWE-502

Связанные уязвимости

github логотип

GHSA-6ccq-w7mc-g74j

github
больше 3 лет назад

A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1). The affected system allows to upload JSON objects that are deserialized to JAVA objects. Due to insecure deserialization of user-supplied content by the affected software, a privileged attacker could exploit this vulnerability by sending a crafted serialized Java object. An exploit could allow the attacker to execute arbitrary code on the device with root privileges.

EPSS

Процентиль: 83%
0.01993
Низкий

7.2 High

CVSS3

9 Critical

CVSS2

Дефекты

CWE-502