CVE-2021-39244

Published: Aug 23, 2021Modified: Nov 21, 2024

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

Authenticated Semi-Blind Command Injection (via Parameter Injection) exists on Altus Nexto, Nexto Xpress, and Hadron Xtorm devices via the getlogs.cgi tcpdump feature. This affects Nexto NX3003 1.8.11.0, Nexto NX3004 1.8.11.0, Nexto NX3005 1.8.11.0, Nexto NX3010 1.8.3.0, Nexto NX3020 1.8.3.0, Nexto NX3030 1.8.3.0, Nexto NX5100 1.8.11.0, Nexto NX5101 1.8.11.0, Nexto NX5110 1.1.2.8, Nexto NX5210 1.1.2.8, Nexto Xpress XP300 1.8.11.0, Nexto Xpress XP315 1.8.11.0, Nexto Xpress XP325 1.8.11.0, Nexto Xpress XP340 1.8.11.0, and Hadron Xtorm HX3040 1.7.58.0.

Affected (15)

Products: Altus: Nexto Nx3003 Firmware, Nexto Nx3004 Firmware, Nexto Nx3005 Firmware, Nexto Nx3010 Firmware, Nexto Nx3020 Firmware, Nexto Nx3030 Firmware, Nexto Nx5100 Firmware, Nexto Nx5101 Firmware, Nexto Nx5110 Firmware, Nexto Nx5210 Firmware, Nexto Xpress Xp300 Firmware, Nexto Xpress Xp315 Firmware, Nexto Xpress Xp325 Firmware, Nexto Xpress Xp340 Firmware, Hadron Xtorm Hx3040 Firmware

Altus

15 products

Nexto Nx3003 Firmware

Nexto Nx3004 Firmware

Nexto Nx3005 Firmware

Nexto Nx3010 Firmware

Nexto Nx3020 Firmware

Nexto Nx3030 Firmware

Nexto Nx5100 Firmware

Nexto Nx5101 Firmware

Nexto Nx5110 Firmware

Nexto Nx5210 Firmware

Nexto Xpress Xp300 Firmware

Nexto Xpress Xp315 Firmware

Nexto Xpress Xp325 Firmware

Nexto Xpress Xp340 Firmware

Hadron Xtorm Hx3040 Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Altus Nexto Nx3003 Firmware	Version 1.8.11.0

Running on/with	Platform Versions
Altus Nexto Nx3003	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Altus Nexto Nx3004 Firmware	Version 1.8.11.0

Running on/with	Platform Versions
Altus Nexto Nx3004	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Altus Nexto Nx3005 Firmware	Version 1.8.11.0

Running on/with	Platform Versions
Altus Nexto Nx3005	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Altus Nexto Nx3010 Firmware	Version 1.8.3.0

Running on/with	Platform Versions
Altus Nexto Nx3010	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Altus Nexto Nx3020 Firmware	Version 1.8.3.0

Running on/with	Platform Versions
Altus Nexto Nx3020	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Altus Nexto Nx3030 Firmware	Version 1.8.3.0

Running on/with	Platform Versions
Altus Nexto Nx3030	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Altus Nexto Nx5100 Firmware	Version 1.8.11.0

Running on/with	Platform Versions
Altus Nexto Nx5100	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Altus Nexto Nx5101 Firmware	Version 1.8.11.0

Running on/with	Platform Versions
Altus Nexto Nx5101	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Altus Nexto Nx5110 Firmware	Version 1.1.2.8

Running on/with	Platform Versions
Altus Nexto Nx5110	All versions

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Altus Nexto Nx5210 Firmware	Version 1.1.2.8

Running on/with	Platform Versions
Altus Nexto Nx5210	All versions

Configuration K

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Altus Nexto Xpress Xp300 Firmware	Version 1.8.11.0

Running on/with	Platform Versions
Altus Nexto Xpress Xp300	All versions

Configuration L

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Altus Nexto Xpress Xp315 Firmware	Version 1.8.11.0

Running on/with	Platform Versions
Altus Nexto Xpress Xp315	All versions

Configuration M

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Altus Nexto Xpress Xp325 Firmware	Version 1.8.11.0

Running on/with	Platform Versions
Altus Nexto Xpress Xp325	All versions

Configuration N

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Altus Nexto Xpress Xp340 Firmware	Version 1.8.11.0

Running on/with	Platform Versions
Altus Nexto Xpress Xp340	All versions

Configuration O

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Altus Hadron Xtorm Hx3040 Firmware	Version 1.7.58.0

Running on/with	Platform Versions
Altus Hadron Xtorm Hx3040	All versions

Related CWEs

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

References (4)

https://seclists.org/fulldisclosure/2021/Aug/21

Source: cve@mitre.org

ExploitMailing ListThird Party Advisory

https://www.altus.com.br/

Source: cve@mitre.org

Vendor Advisory

https://seclists.org/fulldisclosure/2021/Aug/21

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitMailing ListThird Party Advisory

https://www.altus.com.br/

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.