CVE-2021-42257

Published: Oct 11, 2021Modified: Jun 17, 2026

7.1

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Exploitability: 1.8 / Impact: 5.2

Source: NVD

Description

check_smart before 6.9.1 allows unintended drive access by an unprivileged user because it only checks for a substring match of a device path (the /dev/bus substring and a number), aka an unanchored regular expression.

Affected (1)

Products: Check Smart Project: Check Smart

Check Smart Project

1 product

Check Smart

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Check Smart Project Check Smart	Before 6.9.1

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (10)

http://www.openwall.com/lists/oss-security/2021/10/14/2

Source: cve@mitre.org

ExploitThird Party Advisory

https://bugzilla.suse.com/show_bug.cgi?id=1183057

Source: cve@mitre.org

ExploitIssue TrackingPatchThird Party Advisory

https://nvd.nist.gov/vuln/detail/CVE-2021-42257

Source: cve@mitre.org

https://www.claudiokuenzler.com/blog/1068/check_smart-6.9.1-security-fix-release-pseudo-device-path

Source: cve@mitre.org

Third Party Advisory

https://www.claudiokuenzler.com/monitoring-plugins/check_smart.php

Source: cve@mitre.org

Third Party Advisory

http://www.openwall.com/lists/oss-security/2021/10/14/2