CVE-2021-41316

Katalog CVE

CVSS 8.1 · High EPSS 1,4%

Kerentanan Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') pada device42. Skor CVSS 3.1 8.1 (High) menurut NVD.

Deskripsi (NVD)

The Device42 Main Appliance before 17.05.01 does not sanitize user input in its Nmap Discovery utility. An attacker (with permissions to add or edit jobs run by this utility) can inject an extra argument to overwrite arbitrary files as the root user on the Remote Collector.

Rincian

Terbit di NVD

17 September 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.1 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

EPSS (30 hari)

1,4% peluang dieksploitasi; lebih tinggi dari 72,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://blog.device42.com/2021/09/critical-fixes-in-17-05-01/ advisory vendor
• https://docs.device42.com/auto-discovery/nmap-autodiscovery/ product · advisory vendor
• https://docs.device42.com/auto-discovery/remote-collector-rc/ advisory vendor