Vulnerability · Published Nov 14, 2025 · Assigned by VulnCheck
CVE-2021-4466IPCop <= 2.1.9 Authenticated RCE
High 8.7
In plain English
A high-severity OS command injection in IPCop from IPCop Project. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities).
Official description
IPCop versions up to and including 2.1.9 contain an authenticated remote code execution vulnerability within the web-based administration interface. The email configuration component inserts user-controlled values, including the EMAIL_PW parameter, directly into system-level operations without proper input sanitation. By modifying the email password field to include shell metacharacters and issuing a save-and-test-mail action, an authenticated attacker can execute arbitrary operating system commands with the privileges of the web interface, resulting in full system compromise.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| IPCop Project | IPCop | 0 – through 2.1.9 |
Weakness: CWE-78 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References
- https://www.exploit-db.com/exploits/50183 exploit
- https://www.ipcop.org/ product
- https://sourceforge.net/projects/ipcop/ product
- https://www.vulncheck.com/advisories/ipcop-authenticated-rce third-party-advisory