CVEvulnerability
CVE-2021-41316
8.1 HIGH
Official page ↗
- Status
- Modified
- Published
- 2021-09-17
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 8.1 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
- CVSS 2.0 ([email protected])
- 8.5 HIGH — AV:N/AC:L/Au:S/C:N/I:C/A:C
- Weaknesses
- CWE-88
Description
The Device42 Main Appliance before 17.05.01 does not sanitize user input in its Nmap Discovery utility. An attacker (with permissions to add or edit jobs run by this utility) can inject an extra argument to overwrite arbitrary files as the root user on the Remote Collector.
Affected configurations
• device42 device42 (< 17.05.01)
Related
Weakness · CWE (1)
- CWE-88 Improper Neutralization of Argument Delimiters in a Command weakness
References
- https://blog.device42.com/2021/09/critical-fixes-in-17-05-01/ Vendor Advisory
- https://docs.device42.com/auto-discovery/nmap-autodiscovery/ Product, Vendor Advisory
- https://docs.device42.com/auto-discovery/remote-collector-rc/ Vendor Advisory
- https://blog.device42.com/2021/09/critical-fixes-in-17-05-01/ Vendor Advisory
- https://docs.device42.com/auto-discovery/nmap-autodiscovery/ Product, Vendor Advisory
- https://docs.device42.com/auto-discovery/remote-collector-rc/ Vendor Advisory