PT-2021-14834 · Garrett · Ic Module Firmware

Matt Wiseman · Published 2021-12-22 · Updated 2022-07-21 · CVE-2021-21908

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned.

Description The issue allows an authenticated attacker to delete semi-arbitrary files by supplying specially-crafted command line arguments. This is possible because the handle delete function does not sanitize or validate the contents of the file parameter, allowing directory traversal primitives.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2021-21908

Affected Products

Ic Module Firmware

References · 3

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2021-1359 · Exploit
• https://osv.dev/vulnerability/CVE-2021-21908 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-21908 · Security Note