PT-2021-23271 · Device42 · Device42 Main Appliance

Published 2021-09-17 · Updated 2021-09-30 · CVE-2021-41316

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:L/Au:S/C:N/I:C/A:C

Name of the Vulnerable Software and Affected Versions Device42 Main Appliance versions prior to 17.05.01

Description The issue concerns the Nmap Discovery utility in the Device42 Main Appliance, which does not properly sanitize user input. This allows an attacker with permissions to add or edit jobs run by this utility to inject an extra argument, potentially overwriting arbitrary files as the root user on the Remote Collector.

Recommendations For versions prior to 17.05.01, update to version 17.05.01 or later to resolve the issue. As a temporary workaround, consider restricting access to the Nmap Discovery utility and limiting permissions for adding or editing jobs to minimize the risk of exploitation.

Fix

Argument Injection

Weakness Enumeration

CWE-88

Related Identifiers

CVE-2021-41316

Affected Products

Device42 Main Appliance

References · 7

• https://blog.device42.com/2021/09/critical-fixes-in-17-05-01 · Vendor Advisory
• https://docs.device42.com/auto-discovery/remote-collector-rc · Vendor Advisory
• https://docs.device42.com/auto-discovery/nmap-autodiscovery · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-41316 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-41316 · Security Note
• https://t.me/cvenotify/21700 · Telegram Post
• https://t.me/cibsecurity/29050 · Telegram Post