CVEvulnerability

CVE-2021-39244

8.8 HIGH Published 2021-08-23 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2021-08-23
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
9.0 HIGH — AV:N/AC:L/Au:S/C:C/I:C/A:C
Weaknesses
CWE-78

Description

Authenticated Semi-Blind Command Injection (via Parameter Injection) exists on Altus Nexto, Nexto Xpress, and Hadron Xtorm devices via the getlogs.cgi tcpdump feature. This affects Nexto NX3003 1.8.11.0, Nexto NX3004 1.8.11.0, Nexto NX3005 1.8.11.0, Nexto NX3010 1.8.3.0, Nexto NX3020 1.8.3.0, Nexto NX3030 1.8.3.0, Nexto NX5100 1.8.11.0, Nexto NX5101 1.8.11.0, Nexto NX5110 1.1.2.8, Nexto NX5210 1.1.2.8, Nexto Xpress XP300 1.8.11.0, Nexto Xpress XP315 1.8.11.0, Nexto Xpress XP325 1.8.11.0, Nexto Xpress XP340 1.8.11.0, and Hadron Xtorm HX3040 1.7.58.0.

Affected configurations

• altus nexto nx3003 firmware 1.8.11.0 • altus nexto nx3004 firmware 1.8.11.0 • altus nexto nx3005 firmware 1.8.11.0 • altus nexto nx3010 firmware 1.8.3.0 • altus nexto nx3020 firmware 1.8.3.0 • altus nexto nx3030 firmware 1.8.3.0 • altus nexto nx5100 firmware 1.8.11.0 • altus nexto nx5101 firmware 1.8.11.0 • altus nexto nx5110 firmware 1.1.2.8 • altus nexto nx5210 firmware 1.1.2.8 • altus nexto xpress xp300 firmware 1.8.11.0 • altus nexto xpress xp315 firmware 1.8.11.0 • altus nexto xpress xp325 firmware 1.8.11.0 • altus nexto xpress xp340 firmware 1.8.11.0 • altus hadron xtorm hx3040 firmware 1.7.58.0

Related

Weakness · CWE (1)

  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References