deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-3739
Published: 2022-03-10
Description: A NULL pointer dereference flaw was found in the btrfs_rm_device function in fs/btrfs/volumes.c in the Linux Kernel, where triggering the bug requires ‘CAP_SYS_ADMIN’. This flaw allows a local attacker to crash the system or leak kernel internal information. The highest threat from this vulnerability is to system availability.
CVSS Score: 7.1 (HIGH)
CWE: CWE-476, CWE-476
References: https://bugzilla.redhat.com/show_bug.cgi?id=1997958; https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=e4571b8c5e9ffa1e85c0c671995bd4dcc5c75091; https://github.com/torvalds/linux/commit/e4571b8c5e9ffa1e85c0c671995bd4dcc5c75091
CVE: CVE-2021-3981
Published: 2022-03-10
Description: A flaw in grub2 was found where its configuration file, known as grub.cfg, is being created with the wrong permission set allowing non privileged users to read its content. This represents a low severity confidentiality issue, as those users can eventually read any encrypted passwords present in grub.cfg. This flaw affects grub2 2.06 and previous versions. This issue has been fixed in grub upstream but no version with the fix is currently released.
CVSS Score: 3.3 (LOW)
CWE: CWE-276, CWE-276
References: http://www.openwall.com/lists/oss-security/2024/01/15/3; https://bugzilla.redhat.com/show_bug.cgi?id=2024170; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AI776L35DDYPCSAAJPJM3ZEQYSFZHBJX/
CVE: CVE-2021-40047
Published: 2022-03-10
Description: There is a vulnerability of memory not being released after effective lifetime in the Bastet module. Successful exploitation of this vulnerability may affect integrity.
CVSS Score: 7.5 (HIGH)
CWE: CWE-401
References: https://consumer.huawei.com/en/support/bulletin/2022/3/; https://device.harmonyos.com/cn/docs/security/update/security-bulletins-phones-202203-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2022/3/
CVE: CVE-2021-40048
Published: 2022-03-10
Description: There is an incorrect buffer size calculation vulnerability in the video framework. Successful exploitation of this vulnerability will affect availability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-131
References: https://consumer.huawei.com/en/support/bulletin/2022/3/; https://device.harmonyos.com/cn/docs/security/update/security-bulletins-phones-202203-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2022/3/
CVE: CVE-2021-40049
Published: 2022-03-10
Description: There is a permission control vulnerability in the PMS module. Successful exploitation of this vulnerability can lead to sensitive system information being obtained without authorization.
CVSS Score: 7.5 (HIGH)
CWE: CWE-276
References: https://consumer.huawei.com/en/support/bulletin/2022/3/; https://device.harmonyos.com/cn/docs/security/update/security-bulletins-phones-202203-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2022/3/
CVE: CVE-2021-40050
Published: 2022-03-10
Description: There is an out-of-bounds read vulnerability in the IFAA module. Successful exploitation of this vulnerability may cause stack overflow.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125
References: https://consumer.huawei.com/en/support/bulletin/2022/3/; https://device.harmonyos.com/cn/docs/security/update/security-bulletins-phones-202203-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2022/3/
CVE: CVE-2021-40051
Published: 2022-03-10
Description: There is an unauthorized access vulnerability in system components. Successful exploitation of this vulnerability will affect confidentiality.
CVSS Score: 7.5 (HIGH)
References: https://consumer.huawei.com/en/support/bulletin/2022/3/; https://device.harmonyos.com/cn/docs/security/update/security-bulletins-phones-202203-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2022/3/
CVE: CVE-2021-40052
Published: 2022-03-10
Description: There is an incorrect buffer size calculation vulnerability in the video framework.Successful exploitation of this vulnerability may affect availability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-131
References: https://consumer.huawei.com/en/support/bulletin/2022/3/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202208-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2022/3/
CVE: CVE-2021-40053
Published: 2022-03-10
Description: There is a permission control vulnerability in the Nearby module.Successful exploitation of this vulnerability will affect availability and integrity.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-276
References: https://consumer.huawei.com/en/support/bulletin/2022/3/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202209-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2022/3/
CVE: CVE-2021-40054
Published: 2022-03-10
Description: There is an integer underflow vulnerability in the atcmdserver module. Successful exploitation of this vulnerability may affect integrity.
CVSS Score: 7.5 (HIGH)
CWE: CWE-191
References: https://consumer.huawei.com/en/support/bulletin/2022/3/; https://consumer.huawei.com/en/support/bulletin/2022/3/
CVE: CVE-2021-40055
Published: 2022-03-10
Description: There is a man-in-the-middle attack vulnerability during system update download in recovery mode. Successful exploitation of this vulnerability may affect integrity.
CVSS Score: 5.9 (MEDIUM)
References: https://consumer.huawei.com/en/support/bulletin/2022/3/; https://device.harmonyos.com/cn/docs/security/update/security-bulletins-phones-202203-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2022/3/
CVE: CVE-2021-40056
Published: 2022-03-10
Description: There is a vulnerability of copying input buffer without checking its size in the video framework. Successful exploitation of this vulnerability may affect availability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120
References: https://consumer.huawei.com/en/support/bulletin/2022/3/; https://consumer.huawei.com/en/support/bulletin/2022/3/
CVE: CVE-2021-40057
Published: 2022-03-10
Description: There is a heap-based and stack-based buffer overflow vulnerability in the video framework. Successful exploitation of this vulnerability may affect availability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://consumer.huawei.com/en/support/bulletin/2022/3/; https://consumer.huawei.com/en/support/bulletin/2022/3/
CVE: CVE-2021-40058
Published: 2022-03-10
Description: There is a heap-based buffer overflow vulnerability in the video framework. Successful exploitation of this vulnerability may affect availability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://consumer.huawei.com/en/support/bulletin/2022/3/; https://consumer.huawei.com/en/support/bulletin/2022/3/
CVE: CVE-2021-40059
Published: 2022-03-10
Description: There is a permission control vulnerability in the Wi-Fi module. Successful exploitation of this vulnerability may affect confidentiality.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-276
References: https://consumer.huawei.com/en/support/bulletin/2022/3/; https://consumer.huawei.com/en/support/bulletin/2022/3/
CVE: CVE-2021-40060
Published: 2022-03-10
Description: There is a heap-based buffer overflow vulnerability in the video framework. Successful exploitation of this vulnerability may affect availability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://consumer.huawei.com/en/support/bulletin/2022/3/; https://consumer.huawei.com/en/support/bulletin/2022/3/
CVE: CVE-2021-40061
Published: 2022-03-10
Description: There is a vulnerability of accessing resources using an incompatible type (type confusion) in the Bastet module. Successful exploitation of this vulnerability may affect integrity.
CVSS Score: 7.5 (HIGH)
CWE: CWE-843
References: https://consumer.huawei.com/en/support/bulletin/2022/3/; https://device.harmonyos.com/cn/docs/security/update/security-bulletins-phones-202203-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2022/3/
CVE: CVE-2021-40062
Published: 2022-03-10
Description: There is a vulnerability of copying input buffer without checking its size in the video framework. Successful exploitation of this vulnerability may affect availability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120
References: https://consumer.huawei.com/en/support/bulletin/2022/3/; https://consumer.huawei.com/en/support/bulletin/2022/3/
CVE: CVE-2021-40063
Published: 2022-03-10
Description: There is an improper access control vulnerability in the video module. Successful exploitation of this vulnerability may affect confidentiality.
CVSS Score: 7.5 (HIGH)
References: https://consumer.huawei.com/en/support/bulletin/2022/3/; https://device.harmonyos.com/cn/docs/security/update/security-bulletins-phones-202203-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2022/3/
CVE: CVE-2021-40064
Published: 2022-03-10
Description: There is a heap-based buffer overflow vulnerability in system components. Successful exploitation of this vulnerability may affect system stability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://consumer.huawei.com/en/support/bulletin/2022/3/; https://device.harmonyos.com/cn/docs/security/update/security-bulletins-phones-202203-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2022/3/
CVE: CVE-2021-40376
Published: 2022-03-10
Description: otris Update Manager 1.2.1.0 allows local users to achieve SYSTEM access via unauthenticated calls to exposed interfaces over a .NET named pipe. A remote attack may be possible as well, by leveraging WsHTTPBinding for HTTP traffic on TCP port 9000.
CVSS Score: 7.8 (HIGH)
CWE: CWE-287
References: https://www.otris.com; https://www.tuv.com/content-media-files/master-content/global-landingpages/images/vulnerability-disclosure/tuv-rheinland-security-advisory-local-privilege-escalation-vulnerability-in-otris-update-manager.pdf; https://www.tuv.com/landingpage/en/vulnerability-disclosure/
CVE: CVE-2021-41657
Published: 2022-03-10
Description: SmartBear CodeCollaborator v6.1.6102 was discovered to contain a vulnerability in the web UI which would allow an attacker to conduct a clickjacking attack.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-1021
References: http://codecollaborator.com; http://smartbear.com; https://gist.github.com/rvismit/2b1a10a48104e01f575cc948da69df19
CVE: CVE-2021-42186
Published: 2022-03-10
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2021-42786
Published: 2022-03-10
Description: It was discovered that the SteelCentral AppInternals Dynamic Sampling Agent (DSA) has Remote Code Execution vulnerabilities in multiple instances of the API requests. The affected endpoints do not have any input validation of the user's input that allowed a malicious payload to be injected.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20, CWE-20
References: https://aternity.force.com/customersuccess/s/article/Remote-Code-Execution-at-AgentControllerServlet-CVE-2021-42786; https://aternity.force.com/customersuccess/s/article/Remote-Code-Execution-at-AgentControllerServlet-CVE-2021-42786
CVE: CVE-2021-42787
Published: 2022-03-10
Description: It was discovered that the SteelCentral AppInternals Dynamic Sampling Agent's (DSA) AgentConfigurationServlet has directory traversal vulnerabilities at the "/api/appInternals/1.0/agent/configuration" API. The affected endpoint does not have any input validation of the user's input that allows a malicious payload to be injected.
CVSS Score: 9.4 (CRITICAL)
CWE: CWE-20, CWE-22
References: https://aternity.force.com/customersuccess/s/article/Directory-Traversal-Write-Delete-Partial-Read-at-AgentConfigurationServlet-CVE-2021-42787; https://aternity.force.com/customersuccess/s/article/Directory-Traversal-Write-Delete-Partial-Read-at-AgentConfigurationServlet-CVE-2021-42787
CVE: CVE-2021-42853
Published: 2022-03-10
Description: It was discovered that the SteelCentral AppInternals Dynamic Sampling Agent's (DSA) AgentDiagnosticServlet has directory traversal vulnerability at the "/api/appInternals/1.0/agent/diagnostic/logs" API. The affected endpoint does not have any input validation of the user's input that allows a malicious payload to be injected.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-20, CWE-22
References: https://aternity.force.com/customersuccess/s/article/Directory-Traversal-Delete-Read-at-AgentDiagnosticServlet-CVE-2021-42853; https://aternity.force.com/customersuccess/s/article/Directory-Traversal-Delete-Read-at-AgentDiagnosticServlet-CVE-2021-42853
CVE: CVE-2021-42854
Published: 2022-03-10
Description: It was discovered that the SteelCentral AppInternals Dynamic Sampling Agent's (DSA) PluginServlet has directory traversal vulnerabilities at the "/api/appInternals/1.0/plugin/pmx" API. The affected endpoint does not have any input validation of the user's input that allows a malicious payload to be injected.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20, CWE-22
References: https://aternity.force.com/customersuccess/s/article/Directory-Traversal-Read-Write-Delete-at-PluginServlet-CVE-2021-42854; https://aternity.force.com/customersuccess/s/article/Directory-Traversal-Read-Write-Delete-at-PluginServlet-CVE-2021-42854
CVE: CVE-2021-42855
Published: 2022-03-10
Description: It was discovered that the SteelCentral AppInternals Dynamic Sampling Agent (DSA) uses the ".debug_command.config" file to store a json string that contains a list of IDs and pre-configured commands. The config file is subsequently used by the "/api/appInternals/1.0/agent/configuration" API to map the corresponding ID to a command to be executed.
CVSS Score: 7.8 (HIGH)
CWE: CWE-284, CWE-732
References: https://aternity.force.com/customersuccess/s/article/Local-privilege-escalation-due-to-misconfigured-write-permission-on-debug-command-config-file-CVE-2021-42855; https://aternity.force.com/customersuccess/s/article/Local-privilege-escalation-due-to-misconfigured-write-permission-on-debug-command-config-file-CVE-2021-42855
CVE: CVE-2021-42856
Published: 2022-03-10
Description: It was discovered that the /DsaDataTest endpoint is susceptible to Cross-site scripting (XSS) attack. It was noted that the Metric parameter does not have any input checks on the user input that allows an attacker to craft its own malicious payload to trigger a XSS vulnerability.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-20, CWE-79
References: https://aternity.force.com/customersuccess/s/article/Reflected-Cross-site-Scripting-at-DsaDataTest-CVE-2021-42856; https://aternity.force.com/customersuccess/s/article/Reflected-Cross-site-Scripting-at-DsaDataTest-CVE-2021-42856
CVE: CVE-2021-42857
Published: 2022-03-10
Description: It was discovered that the SteelCentral AppInternals Dynamic Sampling Agent's (DSA) AgentDaServlet has directory traversal vulnerabilities at the "/api/appInternals/1.0/agent/da/pcf" API. The affected endpoint does not have any validation of the user's input that allows a malicious payload to be injected.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20, CWE-22
References: https://aternity.force.com/customersuccess/s/article/Directory-Traversal-Partial-Write-at-AgentDaServlet-CVE-2021-42857; https://aternity.force.com/customersuccess/s/article/Directory-Traversal-Partial-Write-at-AgentDaServlet-CVE-2021-42857
CVE: CVE-2021-43969
Published: 2022-03-10
Description: The login.jsp page of Quicklert for Digium 10.0.0 (1043) is affected by both Blind SQL Injection with Out-of-Band Interaction (DNS) and Blind Time-Based SQL Injections. Exploitation can be used to disclose all data within the database (up to and including the administrative accounts' login IDs and passwords) via the login.jsp uname parameter.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://quicklert.com; https://www.assurainc.com/assura-announces-discovery-of-two-vulnerabilities-in-quicklert-for-digium-switchvox/amp-on/; https://quicklert.com
CVE: CVE-2021-43970
Published: 2022-03-10
Description: An arbitrary file upload vulnerability exists in albumimages.jsp in Quicklert for Digium 10.0.0 (1043) via a .mp3;.jsp filename for a file that begins with audio data bytes. It allows an authenticated (low privileged) attacker to execute remote code on the target server within the context of application's permissions (SYSTEM).
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://quicklert.com; https://www.assurainc.com/assura-announces-discovery-of-two-vulnerabilities-in-quicklert-for-digium-switchvox/amp-on/; https://quicklert.com
CVE: CVE-2021-44032
Published: 2022-03-10
Description: TP-Link Omada SDN Software Controller before 5.0.15 does not check if the authentication method specified in a connection request is allowed. An attacker can bypass the captive portal authentication process by using the downgraded "no authentication" method, and access the protected network. For example, the attacker can simply set window.authType=0 in client-side JavaScript.
CVSS Score: 7.5 (HIGH)
References: https://github.com/Orange-Cyberdefense/CVE-repository/blob/master/PoCs/POC_CVE-2021-44032_Kevin.md; https://www.tp-link.com/us/omada-sdn/; https://www.tp-link.com/us/security
CVE: CVE-2021-44215
Published: 2022-03-10
Description: Northern.tech CFEngine Enterprise 3.15.4 before 3.15.5 has Insecure Permissions that may allow unauthorized local users to have an unspecified impact.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-276
References: https://cfengine.com/blog/2022/cve-2021-44215-and-cve-2021-44216/; https://northern.tech; https://cfengine.com/blog/2022/cve-2021-44215-and-cve-2021-44216/
CVE: CVE-2021-44216
Published: 2022-03-10
Description: Northern.tech CFEngine Enterprise before 3.15.5 and 3.18.x before 3.18.1 has Insecure Permissions that may allow unauthorized local users to access the Apache and Mission Portal log files.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-276
References: https://cfengine.com/blog/2022/cve-2021-44215-and-cve-2021-44216/; https://northern.tech; https://cfengine.com/blog/2022/cve-2021-44215-and-cve-2021-44216/
CVE: CVE-2021-44269
Published: 2022-03-10
Description: An out of bounds read was found in Wavpack 5.4.0 in processing *.WAV files. This issue triggered in function WavpackPackSamples of file src/pack_utils.c, tainted variable cnt is too large, that makes pointer sptr read beyond heap bound.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://github.com/dbry/WavPack/issues/110; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2CZUFTX3J4Y4OSRITG4PXCI7NRVFDYVQ/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A5B7L26LA6KGX7YH6SWD5CSBNWKV5MBO/
CVE: CVE-2021-44421
Published: 2022-03-10
Description: The pointer-validation logic in util/mem_util.rs in Occlum before 0.26.0 for Intel SGX acts as a confused deputy that allows a local attacker to access unauthorized information via side-channel analysis.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-203
References: https://github.com/occlum/occlum/blob/821ea843ae21037e6cff5268306d2da1fb131552/src/libos/src/util/mem_util.rs#L130; https://github.com/occlum/occlum/blob/821ea843ae21037e6cff5268306d2da1fb131552/src/libos/src/util/mem_util.rs#L51; https://github.com/occlum/occlum/commit/36918e42bf6732c4d3996bc99eb013eb6b90b249
CVE: CVE-2021-44622
Published: 2022-03-10
Description: A Buffer Overflow vulnerability exists in TP-LINK WR-886N 20190826 2.3.8 in the /cloud_config/router_post/check_reg_verify_code function which could let a remove malicious user execute arbitrary code via a crafted post request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://github.com/Yu3H0/IoT_CVE/tree/main/886N/chkRegVeriRegister; https://github.com/Yu3H0/IoT_CVE/tree/main/886N/chkRegVeriRegister
CVE: CVE-2021-44623
Published: 2022-03-10
Description: A Buffer Overflow vulnerability exists in TP-LINK WR-886N 20190826 2.3.8 via the /cloud_config/router_post/check_reset_pwd_verify_code interface.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://github.com/Yu3H0/IoT_CVE/tree/main/886N/chkResetVeriRegister; https://github.com/Yu3H0/IoT_CVE/tree/main/886N/chkResetVeriRegister
CVE: CVE-2021-44625
Published: 2022-03-10
Description: A Buffer Overflow vulnerability exists in TP-LINK WR-886N 20190826 2.3.8 in /cloud_config/cloud_device/info interface, which allows a malicious user to executee arbitrary code on the system via a crafted post request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://github.com/Yu3H0/IoT_CVE/tree/main/886N/deviceInfoRegister; https://github.com/Yu3H0/IoT_CVE/tree/main/886N/deviceInfoRegister
CVE: CVE-2021-44626
Published: 2022-03-10
Description: A Buffer Overflow vulnerability exists in TP-LINK WR-886N 20190826 2.3.8 in the /cloud_config/router_post/get_reg_verify_code feature, which allows malicious users to execute arbitrary code on the system via a crafted post request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://github.com/Yu3H0/IoT_CVE/tree/main/886N/getRegVeriRegister; https://github.com/Yu3H0/IoT_CVE/tree/main/886N/getRegVeriRegister
CVE: CVE-2021-44627
Published: 2022-03-10
Description: A Buffer Overflow vulnerability exists in TP-LINK WR-886N 20190826 2.3.8 in the /cloud_config/router_post/get_reset_pwd_veirfy_code feature, which allows malicious users to execute arbitrary code on the system via a crafted post request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://github.com/Yu3H0/IoT_CVE/tree/main/886N/getResetVeriRegister; https://github.com/Yu3H0/IoT_CVE/tree/main/886N/getResetVeriRegister
CVE: CVE-2021-44628
Published: 2022-03-10
Description: A Buffer Overflow vulnerabiltiy exists in TP-LINK WR-886N 20190826 2.3.8 in thee /cloud_config/router_post/login feature, which allows malicious users to execute arbitrary code on the system via a crafted post request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://github.com/Yu3H0/IoT_CVE/tree/main/886N/loginRegister; https://github.com/Yu3H0/IoT_CVE/tree/main/886N/loginRegister
CVE: CVE-2021-44629
Published: 2022-03-10
Description: A Buffer Overflow vulnerabilitiy exists in TP-LINK WR-886N 20190826 2.3.8 in the /cloud_config/router_post/register feature, which allows malicious users to execute arbitrary code on the system via a crafted post request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://github.com/Yu3H0/IoT_CVE/tree/main/886N/registerRegister; https://github.com/Yu3H0/IoT_CVE/tree/main/886N/registerRegister
CVE: CVE-2021-44630
Published: 2022-03-10
Description: A Buffer Overflow vulnerability exists in TP-LINK WR-886N 20190826 2.3.8 in the /cloud_config/router_post/modify_account_pwd feature, which allows malicious users to execute arbitrary code on the system via a crafted post request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://github.com/Yu3H0/IoT_CVE/tree/main/886N/modifyAccPwdRegister; https://github.com/Yu3H0/IoT_CVE/tree/main/886N/modifyAccPwdRegister
CVE: CVE-2021-44631
Published: 2022-03-10
Description: A Buffer Overflow vulnerability exists in TP-LINK WR-886N 20190826 2.3.8 in the /cloud_config/router_post/reset_cloud_pwd feature, which allows malicous users to execute arbitrary code on the system via a crafted post request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://github.com/Yu3H0/IoT_CVE/tree/main/886N/resetCloudPwdRegister; https://github.com/Yu3H0/IoT_CVE/tree/main/886N/resetCloudPwdRegister
CVE: CVE-2021-44632
Published: 2022-03-10
Description: A Buffer Overflow vulnerability exists in TP-LINK WR-886N 20190826 2.3.8 in the /cloud_config/router_post/upgrade_info feature, which allows malicious users to execute arbitrary code on the system via a crafted post request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://github.com/Yu3H0/IoT_CVE/tree/main/886N/upgradeInfoRegister; https://github.com/Yu3H0/IoT_CVE/tree/main/886N/upgradeInfoRegister