CVE-2021-35031 Vulnerability Details

  /     /     /  

CVE-2021-35031 Metadata Quick Info

CVE Published: 28/12/2021 | CVE Updated: 04/08/2024 | CVE Year: 2021
Source: Zyxel | Vendor: Zyxel | Product: GS1900 series firmware
Status : PUBLISHED

---

CVE-2021-35031 Description

A vulnerability in the TFTP client of Zyxel GS1900 series firmware, XGS1210 series firmware, and XGS1250 series firmware, which could allow an authenticated LAN user to execute arbitrary OS commands via the GUI of the vulnerable device.

Metrics

CVSS Version: 3.1 | Base Score: 6.8 MEDIUM
Vector: CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

l➤ Exploitability Metrics:
    Attack Vector (AV)* ADJACENT_NETWORK
    Attack Complexity (AC)* LOW
    Privileges Required (PR)* HIGH
    User Interaction (UI)* NONE
    Scope (S)* UNCHANGED

l➤ Impact Metrics:
    Confidentiality Impact (C)* HIGH
    Integrity Impact (I)* HIGH
    Availability Impact (A)* HIGH

Weakness Enumeration (CWE)

CWE-ID: CWE-78
CWE Name: CWE-78: Improper Neutralization of Special Elements used in an OS Command ( OS Command Injection )
Source: Zyxel

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-ID:
CAPEC Description:


Source: NVD (National Vulnerability Database).