CVEvulnerability

CVE-2021-38703

8.8 HIGH Published 2021-09-01 Modified 2026-06-17 Official page ↗

Status: Modified
Published: 2021-09-01
Last modified: 2026-06-17
Assigner: [email protected]
CVSS 3.1 ([email protected]): 8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected]): 9.0 HIGH — AV:N/AC:L/Au:S/C:C/I:C/A:C

Description

Wireless devices running certain Arcadyan-derived firmware (such as KPN Experia WiFi 1.00.15) do not properly sanitise user input to the syslog configuration form. An authenticated remote attacker could leverage this to alter the device configuration and achieve remote code execution. This can be exploited in conjunction with CVE-2021-20090.

Affected configurations

• kpn experia wifi firmware 1.00.15

References

https://7bits.nl/journal/posts/cve-2021-38703-kpn-experia-wifi-root-shell/ Exploit, Third Party Advisory
https://www.kpnwebshop.com/modems-routers/producten/experia-wifi/2 Vendor Advisory
https://7bits.nl/journal/posts/cve-2021-38703-kpn-experia-wifi-root-shell/ Exploit, Third Party Advisory
https://www.kpnwebshop.com/modems-routers/producten/experia-wifi/2 Vendor Advisory