CVE-2021-20039CWE-78

Improper neutralization of special elements in the SMA100 management interface '/cgi-bin/viewcert' POST http method allows a remote authenticated attacker to…

High · published December 8, 2021

Patch now

High probability of exploitation

CVSS calls it high at 8.8. It sits in the 99.6th percentile for exploit probability.

CVSS v3.1
8.8
EPSS
79%
Percentile
99.6
In the wild
Unconfirmed
What it is

Improper neutralization of special elements in the SMA100 management interface '/cgi-bin/viewcert' POST http method allows a remote authenticated attacker to inject arbitrary commands as a 'nobody' user. This vulnerability affected SMA 200, 210, 400, 410 and 500v appliances.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.78746 · 99.6th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2021-12-08T09:55Z
EPSS history
Timeline
  • 08 DEC 09:55Z
    Improper neutralization of special elements in the SMA100 management interface '/cgi-bin/viewcert' POST http method allows a remote authenticated attacker to…
    cvelistv5