CVE-2021-20141 - An unauthenticated command injection vulnerability exists in the parameters of operation 32 in the controller_server service on Gryphon Tower routers

Back Back to CVE browser

HIGH

An unauthenticated command injection vulnerability exists in the parameters of operation 32 in the controller_server service on Gryphon Tower routers

Published Dec 9, 2021

8.8

HIGH

CVSS 3.1

EPSS 3.71%

Description

An unauthenticated command injection vulnerability exists in the parameters of operation 32 in the controller_server service on Gryphon Tower routers. An unauthenticated remote attacker on the same network can execute commands as root on the device by sending a specially crafted malicious packet to the controller_server service on port 9999.

Affected products

Vendor n/a Product Gryphon Tower router Default
n/a
- Version
  <= 04.0004.12 (Current)
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Gryphon Tower router

n/a

Version	Status	Constraints
<= 04.0004.12 (Current)	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-78

OS Command Injection

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-7598
Advisory
https://www.tenable.com/security/research/tra-2021-51
x_refsource_MISCExploitVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-7598		Advisory
https://www.tenable.com/security/research/tra-2021-51		x_refsource_MISCExploitVendor Advisory