PT-2022-12001 · Cdata · C-Data Onu4Ferw

Luis Eduardo Jácome Valencia + 1 · Published 2022-02-25 · Updated 2022-03-08 · CVE-2021-44132

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions C-DATA ONU4FERW version 2.1.13 X139

Description A command injection issue in the function formImportOMCIShell allows attackers to execute arbitrary commands via a crafted file.

Recommendations For version 2.1.13 X139, consider disabling the formImportOMCIShell function until a patch is available to prevent command injection attacks.

Exploit

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2021-44132

Affected Products

C-Data Onu4Ferw

References · 6

• 🔥 https://exploitwriter.io/2022/02/25/os-command-injection-in-c-data-onu4ferw-cve-2021-44132 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-44132 · Security Note
• https://osv.dev/vulnerability/CVE-2021-44132 · Vendor Advisory
• https://exploitwriter.wordpress.com/2021/11/19/remote-code-execution-in-c-data-onu4ferw · Note
• https://t.me/cibsecurity/38131 · Telegram Post
• https://t.me/cvenotify/27405 · Telegram Post