CVE-2021-20138

An unauthenticated command injection vulnerability exists in multiple parameters in the Gryphon Tower router’s web interface at /cgi-bin/luci/rc

published December 9, 2021

CVSS
—
EPSS
4%
Percentile
89.7
In the wild
Unconfirmed
What it is

An unauthenticated command injection vulnerability exists in multiple parameters in the Gryphon Tower router’s web interface at /cgi-bin/luci/rc. An unauthenticated remote attacker on the same network can execute commands as root on the device by sending a specially crafted malicious packet to the web interface.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.03702 · 89.7th percentile
Published
2021-12-09T15:24Z
EPSS history
Timeline
  • 09 DEC 15:24Z
    An unauthenticated command injection vulnerability exists in multiple parameters in the Gryphon Tower router’s web interface at /cgi-bin/luci/rc
    cvelistv5