Vulnerability · Published Sep 15, 2021 · Assigned by twcert
CVE-2021-37913HGiga OAKlouds - Command Injection-2
Critical 9.8
In plain English
A critical-severity OS command injection in OAKlouds OAKSv2 from HGiga. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.8% (higher than 87% of all known vulnerabilities).
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)2.8%top 13.3% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
The HGiga OAKlouds mobile portal does not filter special characters of the IPv6 Gateway parameter of the network interface card setting page. Remote attackers can use this vulnerability to perform command injection and execute arbitrary commands in the system without logging in.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| HGiga | OAKlouds OAKSv2 | OAKlouds-network 2.0 – through OAKlouds-network-2.0-2 |
| HGiga | OAKlouds OAKSv3 | OAKlouds-network 3.0 – through OAKlouds-network-3.0-2 |
Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://www.twcert.org.tw/tw/cp-132-5092-f88e2-1.html x_refsource_MISC