CVE-2021-42071: OS Command Injection
Published Oct 7, 2021
·Updated
In Visual Tools DVR VX16 4.2.28.0, an unauthenticated attacker can achieve remote command execution via shell metacharacters in the cgi-bin/slogin/login.py User-Agent HTTP header.
Affected Software
4 affected components
All of the following
Visual-tools Dvr Vx16 Firmware=4.2.28.0
Visual-tools Dvr Vx16
Visual-tools Dvr Vx16 Firmware=4.2.28.0
Visual-tools Dvr Vx16
Event History
Oct 7, 2021
CVE Published
via MITRE·04:15 PM
Data Sourced
via MITRE·04:15 PM
Description
Data Sourced
via NVD·05:15 PM
DescriptionSeverityWeaknessAffected Software
Oct 18, 58461
Event
11:17 AM
Frequently Asked Questions
1
What is the severity of CVE-2021-42071?
The severity of CVE-2021-42071 is critical with a CVSS score of 9.8.
2
How does an attacker exploit CVE-2021-42071?
An attacker can exploit CVE-2021-42071 by using shell metacharacters in the User-Agent HTTP header of the cgi-bin/slogin/login.py endpoint in Visual Tools DVR VX16 4.2.28.0.
3
Is authentication required for CVE-2021-42071?
No, CVE-2021-42071 can be exploited by an unauthenticated attacker.
4
What is the affected software for CVE-2021-42071?
Visual Tools DVR VX16 4.2.28.0 firmware is affected by CVE-2021-42071.
5
How can I fix CVE-2021-42071?
There is currently no official patch or workaround available for CVE-2021-42071. It is recommended to contact Visual Tools for further assistance.