CVE-2021-40222

Опубликовано: 09 сент. 2021

Источник: nvd

CVSS3: 7.2

CVSS2: 9

EPSS Низкий

Описание

Rittal CMC PU III Web management Version affected: V3.11.00_2. Version fixed: V3.17.10 is affected by a remote code execution vulnerablity. It is possible to introduce shell code to create a reverse shell in the PU-Hostname field of the TCP/IP Configuration dialog. Web application fails to sanitize user input on Network TCP/IP configuration page. This allows the attacker to inject commands as root on the device which will be executed once the data is received.

Ссылки

https://github.com/asang17/CVE-2021-RCE
Exploit
Third Party Advisory
https://github.com/asang17/CVE-2021-RCE
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одновременно

cpe:2.3:o:rittal:cmc_pu_iii_7030.000_firmware:*:*:*:*:*:*:*:*

Версия от 3.11.00_2 (включая) до 3.17.10 (исключая)

cpe:2.3:h:rittal:cmc_pu_iii_7030.000:3.00:*:*:*:*:*:*:*

EPSS

Процентиль: 92%

0.08052

Низкий

7.2 High

CVSS3

9 Critical

CVSS2

Дефекты

CWE-78

Связанные уязвимости

GHSA-cxf9-4ff5-hx4j

github

больше 3 лет назад