PT-2021-23270 · Device42 · Device42 Remote Collector

Published 2021-09-17 · Updated 2021-09-30 · CVE-2021-41315

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Device42 Remote Collector versions prior to 17.05.01

Description The issue allows an authenticated attacker with access to the console application to execute arbitrary OS commands and escalate privileges due to the lack of user input sanitization in the SNMP Connectivity utility.

Recommendations For versions prior to 17.05.01, update to version 17.05.01 or later to resolve the issue. As a temporary workaround, consider restricting access to the console application and the SNMP Connectivity utility to minimize the risk of exploitation.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2021-41315

Affected Products

Device42 Remote Collector

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2021-41315 · Security Note
• https://blog.device42.com/2021/09/critical-fixes-in-17-05-01 · Vendor Advisory
• https://docs.device42.com/auto-discovery/remote-collector-rc · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-41315 · Vendor Advisory
• https://t.me/cibsecurity/29046 · Telegram Post
• https://t.me/cvenotify/21698 · Telegram Post
• https://t.me/cvenotify/21088 · Telegram Post