Vulnerability CVE-2021-42372
Published: 2021-11-08

Description:
A shell command injection in the HW Events SNMP community in XoruX LPAR2RRD and STOR2RRD before 7.30 allows authenticated remote attackers to execute arbitrary shell commands as the user running the service.

Type:

CWE-78

 (Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') )

CVSS2 => (AV:N/AC:L/Au:S/C:C/I:C/A:C)

CVSS Base Score
Impact Subscore
Exploitability Subscore
9/10
10/10
8/10
Exploit range
Attack complexity
Authentication
Remote
Low
Single time
Confidentiality impact
Integrity impact
Availability impact
Complete
Complete
Complete
Affected software
Xorux -> Lpar2rrd 
Xorux -> Stor2rrd 

 References:
https://stor2rrd.com/note730.php
https://lpar2rrd.com/note730.php
Copyright 2024, cxsecurity.com

 

Back to Top