OS Command Injection in Lantronix PremierWave 2050
CVE-2021-21888

9.1CRITICAL

Key Information:

Vendor

Lantronix

Status
Lantronix
Vendor
CVE Published:
22 December 2021

What is CVE-2021-21888?

An OS command injection vulnerability is present in the Web Manager SslGenerateCertificate function within Lantronix PremierWave 2050. This vulnerability can be exploited through specially crafted HTTP requests, allowing an authenticated attacker to execute arbitrary commands on the affected device. Users are encouraged to implement necessary security measures to mitigate the risk.

Affected Version(s)

Lantronix Lantronix PremierWave 2050 8.9.0.0R4 (in QEMU)

References

https://talosintelligence.com/vulnerability_reports/TALOS...
x_refsource_MISC

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.