CVE-2021-33526

Published: Aug 2, 2021Modified: Jun 17, 2026

7.8

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: NVD

Description

In MB connect line mbDIALUP versions <= 3.9R0.0 a low privileged local attacker can send a command to the service running with NT AUTHORITY\SYSTEM instructing it to execute a malicous OpenVPN configuration resulting in arbitrary code execution with the privileges of the service.

Affected (1)

Products: Mbconnectline: Mbdialup

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Mbconnectline Mbdialup	Up to 3.9r0.0

Related CWEs

Improper Privilege Management

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

References (2)

https://cert.vde.com/de-de/advisories/vde-2021-017

Source: info@cert.vde.com

Third Party Advisory

https://cert.vde.com/de-de/advisories/vde-2021-017

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.