9.1
CVE-2021-38484
- EPSS 2.6%
- Veröffentlicht 19.10.2021 13:15:11
- Zuletzt bearbeitet 21.11.2024 06:17:13
- Quelle ics-cert@hq.dhs.gov
- CVE-Watchlists
- Unerledigt
LoginInHand Networks IR615 Router
InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 do not have a filter or signature check to detect or prevent an upload of malicious files to the server, which may allow an attacker, acting as an administrator, to upload malicious files. This could result in cross-site scripting, deletion of system files, and remote code execution.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Inhandnetworks ≫ Ir615 Firmware Version2.3.0.r4724
Inhandnetworks ≫ Ir615 Firmware Version2.3.0.r4870
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 2.6% | 0.833 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 7.2 | 1.2 | 5.9 |
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
|
| nvd@nist.gov | 9 | 8 | 10 |
AV:N/AC:L/Au:S/C:C/I:C/A:C
|
| ics-cert@hq.dhs.gov | 9.1 | 2.3 | 6 |
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
|
CWE-434 Unrestricted Upload of File with Dangerous Type
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
https://us-cert.cisa.gov/ics/advisories/icsa-21-280-05