9

CVE-2021-28151

Exploit
Hongdian H8922 3.0.5 devices allow OS command injection via shell metacharacters into the ip-address (aka Destination) field to the tools.cgi ping command, which is accessible with the username guest and password guest.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Hongdian ≫ H8922 Firmware Version 3.0.5
   Hongdian ≫ H8922 Version -
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 27.91% 0.978
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NIST 9 8 10
AV:N/AC:L/Au:S/C:C/I:C/A:C
CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

http://en.hongdian.com/Products/Details/H8922
Vendor Advisory
Product
https://ssd-disclosure.com/ssd-advisory-hongdian-h8922-multiple-vulnerabilities/
Third Party Advisory
Exploit