Vulnerability · Published Mar 6, 2022 · Assigned by mitre
CVE-2021-46704
Critical 9.8
In plain English
A critical-severity security flaw in the genieacs package (npm). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 21.9% (higher than 98% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)9.8Critical
Exploit odds (30 days)21.9%top 2.3% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling2Nuclei, Public PoC
Official description
In GenieACS 1.2.x before 1.2.8, the UI interface API is vulnerable to unauthenticated OS command injection via the ping host argument (lib/ui/api.ts and lib/ping.ts). The vulnerability arises from insufficient input validation combined with a missing authorization check.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | genieacs | 1.2.8 | GHSA-2877-693q-pj33 |