CVE-2021-33393: ipfire

csirt@kutim:~/threat-intel/cve/CVE-2021-33393

CVSS 8.8 · High EPSS 59,3%

Kerentanan pada ipfire. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

lfs/backup in IPFire 2.25-core155 does not ensure that /var/ipfire/backup/bin/backup.pl is owned by the root account. It might be owned by an unprivileged account, which could potentially be used to install a Trojan horse backup.pl script that is later executed by root. Similar problems with the ownership/permissions of other files may be present as well.

Rincian

Terbit di NVD: 9 Juni 2021
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
EPSS (30 hari): 59,3% peluang dieksploitasi; lebih tinggi dari 99,1% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
ipfire	ipfire	Semua versi sebelum 2.25
ipfire	ipfire	Versi 2.25 core_update141
ipfire	ipfire	Versi 2.25 core_update142
ipfire	ipfire	Versi 2.25 core_update143
ipfire	ipfire	Versi 2.25 core_update144
ipfire	ipfire	Versi 2.25 core_update145
ipfire	ipfire	Versi 2.25 core_update146
ipfire	ipfire	Versi 2.25 core_update147
ipfire	ipfire	Versi 2.25 core_update148
ipfire	ipfire	Versi 2.25 core_update149
ipfire	ipfire	Versi 2.25 core_update150
ipfire	ipfire	Versi 2.25 core_update151
ipfire	ipfire	Versi 2.25 core_update152
ipfire	ipfire	Versi 2.25 core_update155
ipfire	ipfire	Versi 2.25 core_update156

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/ipfire/ipfire-2.x/commit/6769d909306d7bdc43d64598872126fcf1b217f6 patch · advisory pihak ketiga
http://packetstormsecurity.com/files/163158/IPFire-2.25-Remote-Code-Execution.html exploit · advisory pihak ketiga · vdb entry
https://github.com/MucahitSaratar/ipfire-2-25-auth-rce exploit · advisory pihak ketiga
https://github.com/ipfire/ipfire-2.x/commits/master?since=2021-05-17&until=2021-05-17 advisory pihak ketiga

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.