CVE-2021-21551

Katalog CVE

CVSS 7.8 · High KEV · sudah dieksploitasi EPSS 79,2%

Kerentanan Exposed IOCTL with Insufficient Access Control pada dell dbutil. Skor CVSS 3.1 7.8 (High) menurut NVD. Masuk katalog KEV CISA pada 31 Maret 2022, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

Dell dbutil_2_3.sys driver contains an insufficient access control vulnerability which may lead to escalation of privileges, denial of service, or information disclosure. Local authenticated user access is required.

Rincian

Terbit di NVD

4 Mei 2021

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-782: Exposed IOCTL with Insufficient Access Control

EPSS (30 hari)

79,2% peluang dieksploitasi; lebih tinggi dari 99,5% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama

Dell dbutil Driver Insufficient Access Control Vulnerability

Masuk KEV

31 Maret 2022

Tenggat CISA

21 April 2022 (untuk instansi federal AS)

Ransomware

Belum tercatat

Tindakan wajib

Apply updates per vendor instructions.

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.dell.com/support/kbdoc/en-us/000186019/dsa-2021-088-dell-client-platform-security-update-for-dell-... mitigasi · advisory vendor
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-21551 pemerintah AS
• http://packetstormsecurity.com/files/162604/Dell-DBUtil_2_3.sys-IOCTL-Memory-Read-Write.html exploit · advisory pihak ketiga · vdb entry
• http://packetstormsecurity.com/files/162739/DELL-dbutil_2_3.sys-2.3-Arbitrary-Write-Privilege-Escalation.html exploit · advisory pihak ketiga · vdb entry