PT-2021-6850 · Openwrt · Openwrt

Published 2021-12-27 · Updated 2023-05-24 · CVE-2021-45904

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions OpenWrt version 21.02.1

Description The issue exists due to a lack of protection for the web page structure in the OpenWrt embedded operating system. This can be exploited by a remote attacker to impact the confidentiality and integrity of protected information. The vulnerability allows for XSS via the Port Forwards Add Name screen.

Recommendations For OpenWrt version 21.02.1, consider disabling access to the Port Forwards Add Name screen until a patch is available to prevent XSS exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2022-02324

CVE-2021-45904

Affected Products

Openwrt

References · 7

• 🔥 https://bugs.openwrt.org/index.php?do=details&task_id=4199 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-45904 · Security Note
• https://osv.dev/vulnerability/CVE-2021-45904 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-02324 · Security Note
• https://github.com/openwrt/openwrt/issues/9179 · Note
• https://t.me/cibsecurity/34695 · Telegram Post
• https://t.me/cvenotify/51052 · Telegram Post