CVEvulnerability

CVE-2021-45917

9.0 CRITICAL Published 2022-01-03 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2022-01-03
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
8.0 HIGH — CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1 ([email protected])
9.0 CRITICAL — CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS 2.0 ([email protected])
7.7 HIGH — AV:A/AC:L/Au:S/C:C/I:C/A:C
Weaknesses
CWE-287

Description

The server-request receiver function of Shockwall system has an improper authentication vulnerability. An authenticated attacker of an agent computer within the local area network can use the local registry information to launch server-side request forgery (SSRF) attack on another agent computer, resulting in arbitrary code execution for controlling the system or disrupting service.

Affected configurations

• sun moon jingyao network computer terminal protection system firmware (< 7.20.0401)

Related

Weakness · CWE (1)

  • CWE-287 Improper Authentication weakness

References