2021-39244 | Altus Hadron Xtorm HX3040 Parameter getlogs.cgi command injection
|CVSS Meta Temp Score||Current Exploit Price (≈)||CTI Interest Score|
A vulnerability was found in Altus Nexto NX3003, Nexto NX3004, Nexto NX3005, Nexto NX3010, Nexto NX3020, Nexto NX3030, Nexto NX5100, Nexto NX5101, Nexto NX5110, Nexto NX5210, Nexto Xpress XP300, Nexto Xpress XP315, Nexto Xpress XP325, Nexto Xpress XP340 and Hadron Xtorm HX3040. It has been declared as critical. Affected by this vulnerability is some unknown processing of the file getlogs.cgi of the component Parameter Handler. The manipulation with an unknown input leads to a privilege escalation vulnerability. The CWE definition for the vulnerability is CWE-77. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:
Authenticated Semi-Blind Command Injection (via Parameter Injection) exists on Altus Nexto, Nexto Xpress, and Hadron Xtorm devices via the getlogs.cgi tcpdump feature. This affects Nexto NX3003 22.214.171.124, Nexto NX3004 126.96.36.199, Nexto NX3005 188.8.131.52, Nexto NX3010 184.108.40.206, Nexto NX3020 220.127.116.11, Nexto NX3030 18.104.22.168, Nexto NX5100 22.214.171.124, Nexto NX5101 126.96.36.199, Nexto NX5110 188.8.131.52, Nexto NX5210 184.108.40.206, Nexto Xpress XP300 220.127.116.11, Nexto Xpress XP315 18.104.22.168, Nexto Xpress XP325 22.214.171.124, Nexto Xpress XP340 126.96.36.199, and Hadron Xtorm HX3040 188.8.131.52.
The weakness was published 08/23/2021. The advisory is shared at seclists.org. This vulnerability is known as CVE-2021-39244 since 08/17/2021. The exploitation appears to be easy. Access to the local network is required for this attack to succeed. Required for exploitation is a single authentication. Technical details and also a public exploit are known.
It is declared as proof-of-concept. It is possible to download the exploit at seclists.org.
There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.
VulDB Meta Base Score: 5.5
VulDB Meta Temp Score: 5.0
0-Day Time: 🔒
Check our Alexa App!