CVE-2021-21875CWE-78

A specially-crafted HTTP request can lead to arbitrary command execution in EC keypasswd parameter

Critical · published December 22, 2021

CVSS v3.0
9.1
EPSS
3%
Percentile
87.3
In the wild
Unconfirmed
What it is

🚨 A crafty attacker can execute commands at will with just a specially-crafted HTTP request! This flaw in the EC keypasswd parameter is a serious threat that you can't ignore. 🔥 Think of it like a restaurant where a diner can not only order food but also sneak into the kitchen, changing the menu or even tossing ingredients around. This allows malicious individuals to create chaos from the inside! The consequences could be absolutely devastating—an attacker with access could change configurations, leak sensitive data, or even cripple vital systems. Imagine the chaos of a restaurant where every dish is suddenly a surprise, and not the good kind!

Put simply

Think of it like a restaurant where a diner can not only order food but also sneak into the kitchen, changing the menu or even tossing ingredients around. This allows malicious individuals to create chaos from the inside! This vulnerability allows authenticated users to exploit a flaw in the command execution within the EC keypasswd parameter, enabling them to run arbitrary commands on the server. It's like giving a trusted customer a master key to the kitchen!

What to do

The consequences could be absolutely devastating—an attacker with access could change configurations, leak sensitive data, or even cripple vital systems. Imagine the chaos of a restaurant where every dish is suddenly a surprise, and not the good kind! Immediately patch to the latest version that addresses this vulnerability. Restrict access to the EC keypasswd feature to only necessary authenticated users and regularly monitor logs to detect any suspicious activity. Don't let that dinner guest turn into a kitchen nightmare! You've got this! Follow the steps, patch up, and keep your systems as safe as Fort Knox! 🛡️

The record
Technical detail
CVSS v3.0
9.1 · CRITICAL
Vector
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.03011 · 87.3th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2021-12-22T18:06Z
EPSS history
Timeline
  • 22 DEC 18:06Z
    A specially-crafted HTTP request can lead to arbitrary command execution in EC keypasswd parameter
    cvelistv5