CVE-2021-33554CWE-78

UDP Technology/Geutebrück camera devices: Command injection in appfile.filename parameter leading to RCE

High · published September 13, 2021

Patch now

High probability of exploitation

CVSS calls it high at 7.2. It sits in the 99.1th percentile for exploit probability.

CVSS v3.1
7.2
EPSS
59%
Percentile
99.1
In the wild
Unconfirmed
What it is

Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to command injection, which may allow an attacker to remotely execute arbitrary code.

The record
Technical detail
CVSS v3.1
7.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.59169 · 99.1th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2021-09-13T17:55Z
EPSS history
Timeline
  • 13 SEP 17:55Z
    UDP Technology/Geutebrück camera devices: Command injection in appfile.filename parameter leading to RCE
    cvelistv5