CVE-2021-43283: OS Command Injection
An issue was discovered on Victure WR1200 devices through 1.0.3. A command injection vulnerability was found within the web interface of the device, allowing an attacker with valid credentials to inject arbitrary shell commands to be executed by the device with root privileges. This occurs in the ping and traceroute features. An attacker would thus be able to use this vulnerability to open a reverse shell on the device with root privileges.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for the Victure WR1200 devices through 1.0.3?
The vulnerability ID for the Victure WR1200 devices through 1.0.3 is CVE-2021-43283.
What is the severity rating of CVE-2021-43283?
The severity rating of CVE-2021-43283 is critical with a score of 8.8.
How does CVE-2021-43283 affect the Victure WR1200 devices?
CVE-2021-43283 affects the Victure WR1200 devices through 1.0.3 by allowing an attacker with valid credentials to inject arbitrary shell commands with root privileges.
What is the recommended solution to fix CVE-2021-43283?
The recommended solution to fix CVE-2021-43283 is to update the firmware of the Victure WR1200 devices to a version that is not vulnerable.
Where can I find more information about CVE-2021-43283?
You can find more information about CVE-2021-43283 in the technical advisory published by NCC Group at https://research.nccgroup.com/2021/11/12/technical-advisory-multiple-vulnerabilities-in-victure-wr1200-wifi-router-cve-2021-43282-cve-2021-43283-cve-2021-43284/.