PT-2025-47017 · Ipcop · Ipcop

Mücahit Saratar · Published 2025-11-14 · Updated 2025-11-15 · CVE-2021-4466

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions IPCop versions up to and including 2.1.9

Description IPCop versions up to and including 2.1.9 have an issue allowing authenticated remote code execution within the web-based administration interface. The email configuration component inserts user-controlled values, including the EMAIL PW parameter, directly into system-level operations without proper input sanitation. An attacker can execute arbitrary operating system commands with the privileges of the web interface by modifying the email password field to include shell metacharacters and issuing a save-and-test-mail action, potentially leading to full system compromise.

Recommendations Update to a version later than 2.1.9.

Exploit

Fix

RCE

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2021-4466

Affected Products

Ipcop

References · 7

• 🔥 https://exploit-db.com/exploits/50183 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-4466 · Security Note
• https://ipcop.org · Note
• https://vulncheck.com/advisories/ipcop-authenticated-rce · Note
• https://twitter.com/CVEnew/status/1989472530340421779 · Twitter Post
• https://t.me/CVEtracker/37378 · Telegram Post
• https://sourceforge.net/projects/ipcop · Note