CVE-2021-28961: OS Command Injection
applications/luci-app-ddns/luasrc/model/cbi/ddns/detail.lua in the DDNS package for OpenWrt 19.07 allows remote authenticated users to inject arbitrary commands via POST requests.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2021-28961?
CVE-2021-28961 is a vulnerability in the DDNS package for OpenWrt 19.07 that allows remote authenticated users to inject arbitrary commands via POST requests.
What is the severity of CVE-2021-28961?
The severity of CVE-2021-28961 is high with a CVSS score of 8.8.
How can remote authenticated users exploit CVE-2021-28961?
Remote authenticated users can exploit CVE-2021-28961 by sending malicious POST requests to the affected application.
Is there a fix for CVE-2021-28961?
Yes, a patch has been released by OpenWrt. Please refer to the provided references for more information.
What is the Common Weakness Enumeration (CWE) for CVE-2021-28961?
CVE-2021-28961 is categorized under CWE-78, which is Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection').