How severe is CVE-2021-42324?

This vulnerability has a severity rating of HIGH with a CVSS score of 7.4 out of 10.

What type of vulnerability is CVE-2021-42324?

This is classified as CWE-78, which is a common weakness in software security.

CVE-2021-42324 - HIGH Severity | CVSS 7.4

Vulnerability Description

An issue was discovered on DCN (Digital China Networks) S4600-10P-SI devices before R0241.0470. Due to improper parameter validation in the console interface, it is possible for a low-privileged authenticated attacker to escape the sandbox environment and execute system commands as root via shell metacharacters in the capture command parameters. Command output will be shown on the Serial interface of the device. Exploitation requires both credentials and physical access.

Related Vulnerabilities

CVE-2015-4956

HIGH

CVSS:7.4(High)

The Web UI in IBM Security QRadar SIEM 7.1.x before 7.1 MR2 Patch 12 allows remote authenticated users to execute unspecified OS commands via unknown vectors.

CWE-782015

CVE-2017-3506

HIGH

CVSS:7.4(High)

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supported versions that are affected are 10.3.6.0, 12.1.3.0, 12.2.1.0, 12.2.1.1 and 12.2...

CWE-782017

CVE-2018-6021

HIGH

CVSS:7.4(High)

Silex SD-320AN version 2.01 and prior and GE MobileLink(GEH-SD-320AN) version GEH-1.1 and prior have a system call parameter that is not properly sanitized, which may allow remote code execution.

CWE-782018

CVE-2020-1734

HIGH

CVSS:7.4(High)

A flaw was found in the pipe lookup plugin of ansible. Arbitrary commands can be run, when the pipe lookup plugin uses subprocess.Popen() with shell=True, by overwriting ansible facts and the variable...

CWE-782020

CVE-2020-6757

HIGH

CVSS:7.4(High)

contentHostProperties.php in Rasilient PixelStor 5000 K:4.0.1580-20150629 (KDI Version) allows authenticated attackers to remotely execute code via the name parameter.

CWE-782020

CVE-2024-27920

HIGH

CVSS:7.4(High)

projectdiscovery/nuclei is a fast and customisable vulnerability scanner based on simple YAML based DSL. A significant security oversight was identified in Nuclei v3, involving the execution of unsign...

CWE-782024