CVE-2021-40222

Published: Sep 9, 2021Modified: Nov 21, 2024

7.2

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.2 / Impact: 5.9

Source: NVD

Description

Rittal CMC PU III Web management Version affected: V3.11.00_2. Version fixed: V3.17.10 is affected by a remote code execution vulnerablity. It is possible to introduce shell code to create a reverse shell in the PU-Hostname field of the TCP/IP Configuration dialog. Web application fails to sanitize user input on Network TCP/IP configuration page. This allows the attacker to inject commands as root on the device which will be executed once the data is received.

Affected (1)

Products: Rittal: Cmc Pu Iii 7030.000 Firmware

1 product

Cmc Pu Iii 7030.000 Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Rittal Cmc Pu Iii 7030.000 Firmware	From 3.11.00_2 to 3.17.10

Running on/with	Platform Versions
Rittal Cmc Pu Iii 7030.000	Version 3.00

Related CWEs

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

References (2)

https://github.com/asang17/CVE-2021-RCE

Source: cve@mitre.org

ExploitThird Party Advisory

https://github.com/asang17/CVE-2021-RCE

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

Timeline

No history available yet.