PT-2021-21904 · Hgiga · Hgiga Oaklouds Mobile Portal

Weber Tsai · Published 2021-09-15 · Updated 2021-09-28 · CVE-2021-37912

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: HGiga OAKlouds mobile portal (affected versions not specified)

Description: The HGiga OAKlouds mobile portal does not filter special characters of the Ethernet number parameter of the network interface card setting page. Remote attackers can use this issue to perform command injection and execute arbitrary commands in the system without logging in.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2021-37912

Affected Products

Hgiga Oaklouds Mobile Portal

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2021-37912 · Security Note
• https://osv.dev/vulnerability/CVE-2021-37912 · Vendor Advisory
• https://t.me/cibsecurity/28936 · Telegram Post
• https://t.me/cvenotify/20907 · Telegram Post
• https://twcert.org.tw/tw/cp-132-5091-7e0c5-1.html · Note
• https://t.me/cvenotify/20927 · Telegram Post