stasvinokur/cve-and-cwe-dataset-1999-2025 huggingface dataset:
CVE-2021-42147 (severity: CRITICAL, weakness: CWE-125)
Buffer over-read vulnerability in the dtls_sha256_update function in Contiki-NG tinyDTLS through master branch 53a0d97 allows remote attackers to cause a denial of service via crafted data packet.
CVE-2021-4216 (severity: MEDIUM, weakness: CWE-369)
A Floating point exception (division-by-zero) flaw was found in Mupdf for zero width pages in muraster.c. It is fixed in Mupdf-1.20.0-rc1 upstream.
CVE-2021-42165 (severity: HIGH, weakness: CWE-78)
MitraStar GPT-2541GNAC-N1 (HGU) 100VNZ0b33 devices allow remote authenticated users to obtain root access by executing command "deviceinfo show file &&/bin/bash" because of incorrect sanitization of parameter "path".
CVE-2021-42168 (severity: MEDIUM, weakness: CWE-79)
Cross Site Scripting (XSS) in Sourcecodester Try My Recipe (Recipe Sharing Website - CMS) by oretnom23, allows attackers to gain the PHPSESID or other unspecified impacts via the fullname parameter to the login_registration page.
CVE-2021-42169 (severity: CRITICAL, weakness: CWE-89)
The Simple Payroll System with Dynamic Tax Bracket in PHP using SQLite Free Source Code (by: oretnom23 ) is vulnerable from remote SQL-Injection-Bypass-Authentication for the admin account. The parameter (username) from the login form is not protected correctly and there is no security and escaping from malicious payloads.
CVE-2021-4217 (severity: LOW, weakness: CWE-476)
A flaw was found in unzip. The vulnerability occurs due to improper handling of Unicode strings, which can lead to a null pointer dereference. This flaw allows an attacker to input a specially crafted zip file, leading to a crash or code execution.
CVE-2021-42171 (severity: HIGH, weakness: CWE-434)
Zenario CMS 9.0.54156 is vulnerable to File Upload. The web server can be compromised by uploading and executing a web-shell which can run commands, browse system files, browse local resources, attack other servers, and exploit the local vulnerabilities, and so forth.
CVE-2021-4218 (severity: MEDIUM, weakness: CWE-665)
A flaw was found in the Linux kernel’s implementation of reading the SVC RDMA counters. Reading the counter sysctl panics the system. This flaw allows a local attacker with local access to cause a denial of service while the system reboots. The issue is specific to CentOS/RHEL.
CVE-2021-42183 (severity: HIGH, weakness: CWE-22)
MasaCMS 7.2.1 is affected by a path traversal vulnerability in /index.cfm/_api/asset/image/.
CVE-2021-42185 (severity: CRITICAL, weakness: CWE-89)
wdja v2.1 is affected by a SQL injection vulnerability in the foreground search function.
CVE-2021-4219 (severity: MEDIUM, weakness: CWE-20)
A flaw was found in ImageMagick. The vulnerability occurs due to improper use of open functions and leads to a denial of service. This flaw allows an attacker to crash the system.
CVE-2021-42192 (severity: HIGH, weakness: CWE-863)
Konga v0.14.9 is affected by an incorrect access control vulnerability where a specially crafted request can lead to privilege escalation.
CVE-2021-42194 (severity: HIGH, weakness: CWE-611)
The wechat_return function in /controller/Index.php of EyouCms V1.5.4-UTF8-SP3 passes the user's input directly into the simplexml_ load_ String function, which itself does not prohibit external entities, triggering a XML external entity (XXE) injection vulnerability.
CVE-2021-42195 (severity: HIGH, weakness: CWE-787)
An issue was discovered in swftools through 20201222. A heap-buffer-overflow exists in the function handleEditText() located in swfdump.c. It allows an attacker to cause code Execution.
CVE-2021-42196 (severity: MEDIUM, weakness: CWE-476)
An issue was discovered in swftools through 20201222. A NULL pointer dereference exists in the function traits_parse() located in abc.c. It allows an attacker to cause Denial of Service.
CVE-2021-42197 (severity: HIGH, weakness: CWE-401)
An issue was discovered in swftools through 20201222 through a memory leak in the swftools when swfdump is used. It allows an attacker to cause code execution.
CVE-2021-42198 (severity: MEDIUM, weakness: CWE-476)
An issue was discovered in swftools through 20201222. A NULL pointer dereference exists in the function swf_GetBits() located in rfxswf.c. It allows an attacker to cause Denial of Service.
CVE-2021-42199 (severity: HIGH, weakness: CWE-787)
An issue was discovered in swftools through 20201222. A heap buffer overflow exists in the function swf_FontExtract_DefineTextCallback() located in swftext.c. It allows an attacker to cause code execution.
CVE-2021-42200 (severity: MEDIUM, weakness: CWE-476)
An issue was discovered in swftools through 20201222. A NULL pointer dereference exists in the function main() located in swfdump.c. It allows an attacker to cause Denial of Service.
CVE-2021-42201 (severity: HIGH, weakness: CWE-787)
An issue was discovered in swftools through 20201222. A heap-buffer-overflow exists in the function swf_GetD64() located in rfxswf.c. It allows an attacker to cause code execution.
CVE-2021-42202 (severity: MEDIUM, weakness: CWE-476)
An issue was discovered in swftools through 20201222. A NULL pointer dereference exists in the function swf_DeleteFilter() located in swffilter.c. It allows an attacker to cause Denial of Service.
CVE-2021-42203 (severity: HIGH, weakness: CWE-416)
An issue was discovered in swftools through 20201222. A heap-use-after-free exists in the function swf_FontExtract_DefineTextCallback() located in swftext.c. It allows an attacker to cause code execution.
CVE-2021-42204 (severity: HIGH, weakness: CWE-787)
An issue was discovered in swftools through 20201222. A heap-buffer-overflow exists in the function swf_GetBits() located in rfxswf.c. It allows an attacker to cause code execution.
CVE-2021-42205 (severity: MEDIUM, weakness: CWE-703)
ELAN Miniport touchpad Windows driver before 24.21.51.2, as used in PC hardware from multiple manufacturers, allows local users to cause a system crash by sending a certain IOCTL request, because that request is handled twice.
CVE-2021-4221 (severity: MEDIUM, weakness: CWE-1007)
If a domain name contained a RTL character, it would cause the domain to be rendered to the right of the path. This could lead to user confusion and spoofing attacks. <br>*This bug only affects Firefox for Android. Other operating systems are unaffected.*<br>*Note*: Due to a clerical error this advisory was not included in the original announcement, and was added in Feburary 2022. This vulnerability affects Firefox < 92.
CVE-2021-42216 (severity: CRITICAL, weakness: CWE-326)
A Broken or Risky Cryptographic Algorithm exists in AnonAddy 0.8.5 via VerificationController.php.
CVE-2021-42218 (severity: HIGH, weakness: CWE-401)
OMPL v1.5.2 contains a memory leak in VFRRT.cpp
CVE-2021-42219 (severity: HIGH, weakness: NVD-CWE-Other)
Go-Ethereum v1.10.9 was discovered to contain an issue which allows attackers to cause a denial of service (DoS) via sending an excessive amount of messages to a node. This is caused by missing memory in the component /ethash/algorithm.go.
CVE-2021-4222 (severity: MEDIUM, weakness: CWE-79)
The WP-Paginate WordPress plugin before 2.1.4 does not sanitise and escape its preset settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed
CVE-2021-42220 (severity: MEDIUM, weakness: CWE-79)
A Cross Site Scripting (XSS) vulnerability exists in Dolibarr before 14.0.3 via the ticket creation flow. Exploitation requires that an admin copies the payload into a box.
CVE-2021-42223 (severity: MEDIUM, weakness: CWE-79)
Cross Site Scripting (XSS).vulnerability exists in Online DJ Booking Management System 1.0 in view-booking-detail.php.
CVE-2021-42224 (severity: CRITICAL, weakness: CWE-89)
SQL Injection vulnerability exists in IFSC Code Finder Project 1.0 via the searchifsccode POST parameter in /search.php.
CVE-2021-42227 (severity: MEDIUM, weakness: CWE-79)
Cross SIte Scripting (XSS) vulnerability exists in KindEditor 4.1.x via a Google search inurl:/examples/uploadbutton.html and then the .html file on the website that uses this editor (the file suffix is allowed).
CVE-2021-42228 (severity: HIGH, weakness: CWE-352)
A Cross Site Request Forgery (CSRF) vulnerability exists in KindEditor 4.1.x, as demonstrated by examples/uploadbutton.html.
CVE-2021-42230 (severity: CRITICAL, weakness: NVD-CWE-Other)
Seowon 130-SLC router all versions as of 2021-09-15 is vulnerable to Remote Code Execution via the queriesCnt parameter.
CVE-2021-42232 (severity: CRITICAL, weakness: CWE-78)
TP-Link Archer A7 Archer A7(US)_V5_210519 is affected by a command injection vulnerability in /usr/bin/tddp. The vulnerability is caused by the program taking part of the received data packet as part of the command. This will cause an attacker to execute arbitrary commands on the router.
CVE-2021-42233 (severity: MEDIUM, weakness: CWE-79)
The Simple Blog plugin in Wondercms 3.4.1 is vulnerable to stored cross-site scripting (XSS) vulnerability. When any user opens a particular blog hosted on an attackers' site, XSS may occur.
CVE-2021-42235 (severity: CRITICAL, weakness: CWE-89)
SQL injection in osTicket before 1.14.8 and 1.15.4 login and password reset process allows attackers to access the osTicket administration profile functionality.
CVE-2021-42237 (severity: CRITICAL, weakness: CWE-502)
Sitecore XP 7.5 Initial Release to Sitecore XP 8.2 Update-7 is vulnerable to an insecure deserialization attack where it is possible to achieve remote command execution on the machine. No authentication or special configuration is required to exploit this vulnerability.
CVE-2021-42242 (severity: CRITICAL, weakness: NVD-CWE-Other)
A command execution vulnerability exists in jfinal_cms 5.0.1 via com.jflyfox.component.controller.Ueditor.
CVE-2021-42244 (severity: MEDIUM, weakness: CWE-79)
A cross-site scripting (XSS) vulnerability in PaquitoSoftware Notimoo v1.2 allows attackers to execute arbitrary web scripts or HTML via a crafted title or message in a notification.
CVE-2021-42245 (severity: MEDIUM, weakness: CWE-79)
FlatCore-CMS 2.0.9 has a cross-site scripting (XSS) vulnerability in pages.edit.php through meta tags and content sections.
CVE-2021-4225 (severity: HIGH, weakness: CWE-434)
The SP Project & Document Manager WordPress plugin before 4.24 allows any authenticated users, such as subscribers, to upload files. The plugin attempts to prevent PHP and other similar files that could be executed on the server from being uploaded by checking the file extension. It was discovered that on Windows servers, the security checks in place were insufficient, enabling bad actors to potentially upload backdoors on vulnerable sites.
CVE-2021-42250 (severity: MEDIUM, weakness: CWE-117)
Improper output neutralization for Logs. A specific Apache Superset HTTP endpoint allowed for an authenticated user to forge log entries or inject malicious content into logs.
CVE-2021-42252 (severity: HIGH, weakness: NVD-CWE-Other)
An issue was discovered in aspeed_lpc_ctrl_mmap in drivers/soc/aspeed/aspeed-lpc-ctrl.c in the Linux kernel before 5.14.6. Local attackers able to access the Aspeed LPC control interface could overwrite memory in the kernel and potentially execute privileges, aka CID-b49a0e69a7b1. This occurs because a certain comparison uses values that are not memory sizes.
CVE-2021-42254 (severity: HIGH, weakness: CWE-668)
BeyondTrust Privilege Management prior to version 21.6 creates a Temporary File in a Directory with Insecure Permissions.
CVE-2021-42255 (severity: HIGH, weakness: CWE-668)
AppGuard Enterprise before 6.7.100.1 creates a Temporary File in a Directory with Insecure Permissions. Local users can gain SYSTEM privileges because a repair operation relies on the %TEMP% directory of an unprivileged user.
CVE-2021-42257 (severity: HIGH, weakness: CWE-20)
check_smart before 6.9.1 allows unintended drive access by an unprivileged user because it only checks for a substring match of a device path (the /dev/bus substring and a number), aka an unanchored regular expression.
CVE-2021-42258 (severity: CRITICAL, weakness: CWE-89)
BQE BillQuick Web Suite 2018 through 2021 before 22.0.9.1 allows SQL injection for unauthenticated remote code execution, as exploited in the wild in October 2021 for ransomware installation. SQL injection can, for example, use the txtID (aka username) parameter. Successful exploitation can include the ability to execute arbitrary code as MSSQLSERVER$ via xp_cmdshell.
CVE-2021-4226 (severity: CRITICAL, weakness: CWE-345)
RSFirewall tries to identify the original IP address by looking at different HTTP headers. A bypass is possible due to the way it is implemented.
CVE-2021-42260 (severity: HIGH, weakness: CWE-835)
TinyXML through 2.6.2 has an infinite loop in TiXmlParsingData::Stamp in tinyxmlparser.cpp via the TIXML_UTF_LEAD_0 case. It can be triggered by a crafted XML message and leads to a denial of service.
CVE-2021-42261 (severity: HIGH, weakness: CWE-22)
Revisor Video Management System (VMS) before 2.0.0 has a directory traversal vulnerability. Successful exploitation could allow an attacker to traverse the file system to access files or directories that are outside of restricted directory on the remote server. This could lead to the disclosure of sensitive data on the vulnerable server.
CVE-2021-42262 (severity: MEDIUM, weakness: CWE-119)
An issue was discovered in Softing OPC UA C++ SDK before 5.70. An invalid XML element in the type dictionary makes the OPC/UA client crash due to an out-of-memory condition.
CVE-2021-42263 (severity: MEDIUM, weakness: CWE-476)
Adobe Premiere Pro 15.4.1 (and earlier) is affected by a Null pointer dereference vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to achieve an application denial-of-service in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2021-42264 (severity: MEDIUM, weakness: CWE-476)
Adobe Premiere Pro 15.4.1 (and earlier) is affected by a Null pointer dereference vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to achieve an application denial-of-service in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2021-42265 (severity: MEDIUM, weakness: CWE-125)
Adobe Premiere Pro versions 22.0 (and earlier) and 15.4.2 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2021-42266 (severity: HIGH, weakness: CWE-788)
Adobe Animate version 21.0.9 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious FLA file, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required to exploit this vulnerability.
CVE-2021-42267 (severity: HIGH, weakness: CWE-788)
Adobe Animate version 21.0.9 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious FLA file, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required to exploit this vulnerability.
CVE-2021-42268 (severity: MEDIUM, weakness: CWE-476)
Adobe Animate version 21.0.9 (and earlier) is affected by a Null pointer dereference vulnerability when parsing a specially crafted FLA file. An unauthenticated attacker could leverage this vulnerability to achieve an application denial-of-service in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2021-42269 (severity: HIGH, weakness: CWE-416)
Adobe Animate version 21.0.9 (and earlier) are affected by a use-after-free vulnerability in the processing of a malformed FLA file that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2021-4227 (severity: MEDIUM, weakness: CWE-74)
The ark-commenteditor WordPress plugin through 2.15.6 does not properly sanitise or encode the comments when in Source editor, allowing attackers to inject an iFrame in the page and thus load arbitrary content from any page to the comment section
CVE-2021-42270 (severity: HIGH, weakness: CWE-787)
Adobe Animate version 21.0.9 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious BMP file.
CVE-2021-42271 (severity: HIGH, weakness: CWE-787)
Adobe Animate version 21.0.9 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious BMP file.
CVE-2021-42272 (severity: HIGH, weakness: CWE-787)
Adobe Animate version 21.0.9 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious GIF file.
CVE-2021-42274 (severity: MEDIUM, weakness: NVD-CWE-Other)
Windows Hyper-V Discrete Device Assignment (DDA) Denial of Service Vulnerability
CVE-2021-42275 (severity: HIGH, weakness: NVD-CWE-Other)
Microsoft COM for Windows Remote Code Execution Vulnerability
CVE-2021-42276 (severity: HIGH, weakness: NVD-CWE-Other)
Microsoft Windows Media Foundation Remote Code Execution Vulnerability
CVE-2021-42277 (severity: HIGH, weakness: CWE-269)
Diagnostics Hub Standard Collector Elevation of Privilege Vulnerability
CVE-2021-42278 (severity: HIGH, weakness: NVD-CWE-Other)
Active Directory Domain Services Elevation of Privilege Vulnerability
CVE-2021-42279 (severity: HIGH, weakness: CWE-787)
Chakra Scripting Engine Memory Corruption Vulnerability
CVE-2021-4228 (severity: HIGH, weakness: CWE-321)
Use of hard-coded TLS certificate by default allows an attacker to perform Man-in-the-Middle (MitM) attacks even in the presence of the HTTPS connection. This issue affects: Lanner Inc IAC-AST2500A standard firmware version 1.00.0.
CVE-2021-42280 (severity: HIGH, weakness: CWE-269)
Windows Feedback Hub Elevation of Privilege Vulnerability
CVE-2021-42282 (severity: HIGH, weakness: CWE-269)
Active Directory Domain Services Elevation of Privilege Vulnerability
CVE-2021-42283 (severity: HIGH, weakness: CWE-269)
NTFS Elevation of Privilege Vulnerability
CVE-2021-42284 (severity: HIGH, weakness: NVD-CWE-Other)
Windows Hyper-V Denial of Service Vulnerability
CVE-2021-42285 (severity: HIGH, weakness: CWE-269)
Windows Kernel Elevation of Privilege Vulnerability
CVE-2021-42286 (severity: HIGH, weakness: CWE-269)
Windows Core Shell SI Host Extension Framework for Composable Shell Elevation of Privilege Vulnerability
CVE-2021-42287 (severity: HIGH, weakness: NVD-CWE-Other)
Active Directory Domain Services Elevation of Privilege Vulnerability
CVE-2021-42288 (severity: MEDIUM, weakness: NVD-CWE-Other)
Windows Hello Security Feature Bypass Vulnerability
CVE-2021-4229 (severity: HIGH, weakness: CWE-912)
A vulnerability was found in ua-parser-js 0.7.29/0.8.0/1.0.0. It has been rated as critical. This issue affects the crypto mining component which introduces a backdoor. Upgrading to version 0.7.30, 0.8.1 and 1.0.1 is able to address this issue. It is recommended to upgrade the affected component.
CVE-2021-42291 (severity: HIGH, weakness: CWE-269)
Active Directory Domain Services Elevation of Privilege Vulnerability
CVE-2021-42292 (severity: HIGH, weakness: NVD-CWE-Other)
Microsoft Excel Security Feature Bypass Vulnerability
CVE-2021-42293 (severity: MEDIUM, weakness: NVD-CWE-Other)
Microsoft Jet Red Database Engine and Access Connectivity Engine Elevation of Privilege Vulnerability
CVE-2021-42294 (severity: HIGH, weakness: NVD-CWE-Other)
Microsoft SharePoint Server Remote Code Execution Vulnerability
CVE-2021-42295 (severity: MEDIUM, weakness: NVD-CWE-Other)
Visual Basic for Applications Information Disclosure Vulnerability
CVE-2021-42296 (severity: HIGH, weakness: CWE-94)
Microsoft Word Remote Code Execution Vulnerability
CVE-2021-42297 (severity: HIGH, weakness: CWE-59)
Windows 10 Update Assistant Elevation of Privilege Vulnerability
CVE-2021-42298 (severity: HIGH, weakness: CWE-94)
Microsoft Defender Remote Code Execution Vulnerability
CVE-2021-42299 (severity: MEDIUM, weakness: NVD-CWE-Other)
Microsoft Surface Pro 3 Security Feature Bypass Vulnerability
CVE-2021-4230 (severity: HIGH, weakness: CWE-287)
A vulnerability has been found in Airfield Online and classified as problematic. This vulnerability affects the path /backups/ of the MySQL backup handler. An attacker is able to get access to sensitive data without proper authentication. It is recommended to the change the configuration settings.
CVE-2021-42300 (severity: MEDIUM, weakness: NVD-CWE-Other)
Azure Sphere Tampering Vulnerability
CVE-2021-42301 (severity: MEDIUM, weakness: NVD-CWE-Other)
Azure RTOS Information Disclosure Vulnerability
CVE-2021-42302 (severity: MEDIUM, weakness: CWE-269)
Azure RTOS Elevation of Privilege Vulnerability
CVE-2021-42303 (severity: MEDIUM, weakness: CWE-269)
Azure RTOS Elevation of Privilege Vulnerability
CVE-2021-42304 (severity: MEDIUM, weakness: CWE-269)
Azure RTOS Elevation of Privilege Vulnerability
CVE-2021-42305 (severity: MEDIUM, weakness: NVD-CWE-Other)
Microsoft Exchange Server Spoofing Vulnerability
CVE-2021-42306 (severity: MEDIUM, weakness: CWE-522)
An information disclosure vulnerability manifests when a user or an application uploads unprotected private key data as part of an authentication certificate keyCredential on an Azure AD Application or Service Principal (which is not recommended). This vulnerability allows a user or service in the tenant with application read access to read the private key data that was added to the application. Azure AD addressed this vulnerability by preventing disclosure of any private key values added to the application. Microsoft has identified services that could manifest this vulnerability, and steps that customers should take to be protected. Refer to the FAQ section for more information. For more details on this issue, please refer to the MSRC Blog Entry.
CVE-2021-42307 (severity: MEDIUM, weakness: NVD-CWE-Other)
Microsoft Edge (Chromium-based) Information Disclosure Vulnerability
CVE-2021-42308 (severity: HIGH, weakness: CWE-290)
Microsoft Edge (Chromium-based) Spoofing Vulnerability
CVE-2021-42309 (severity: HIGH, weakness: CWE-94)
Microsoft SharePoint Server Remote Code Execution Vulnerability
CVE-2021-4231 (severity: MEDIUM, weakness: CWE-79)
A vulnerability was found in Angular up to 11.0.4/11.1.0-next.2. It has been classified as problematic. Affected is the handling of comments. The manipulation leads to cross site scripting. It is possible to launch the attack remotely but it might require an authentication first. Upgrading to version 11.0.5 and 11.1.0-next.3 is able to address this issue. The name of the patch is ba8da742e3b243e8f43d4c63aa842b44e14f2b09. It is recommended to upgrade the affected component.
CVE-2021-42310 (severity: CRITICAL, weakness: NVD-CWE-Other)
Microsoft Defender for IoT Remote Code Execution Vulnerability
CVE-2021-42311 (severity: CRITICAL, weakness: CWE-89)
Microsoft Defender for IoT Remote Code Execution Vulnerability
CVE-2021-42312 (severity: HIGH, weakness: NVD-CWE-Other)
Microsoft Defender for IoT Elevation of Privilege Vulnerability
CVE-2021-42313 (severity: CRITICAL, weakness: CWE-89)
Microsoft Defender for IoT Remote Code Execution Vulnerability
CVE-2021-42314 (severity: HIGH, weakness: NVD-CWE-Other)
Microsoft Defender for IoT Remote Code Execution Vulnerability
CVE-2021-42315 (severity: HIGH, weakness: NVD-CWE-Other)
Microsoft Defender for IoT Remote Code Execution Vulnerability