CVE-2021-21551
Last modified
CVE-2021-21551 is a high-severity vulnerability rated 7.8/10 on the CVSS scale. Dell dbutil_2_3.sys driver contains an insufficient access control vulnerability which may lead to escalation of privileges, denial of service, or information disclosure. Local authenticated user access is required.. CISA has confirmed active exploitation in the wild. EPSS estimates a 57.47% chance of exploitation in the next 30 days.
Description
Dell dbutil_2_3.sys driver contains an insufficient access control vulnerability which may lead to escalation of privileges, denial of service, or information disclosure. Local authenticated user access is required.
Metrics
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Exploitation Status
This vulnerability is listed in CISA’s Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. Federal agencies must remediate by .
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Dell | Dbutil | <= 2.3 |
References
- http://packetstormsecurity.com/files/162604/Dell-DBUtil_2_3.sys-IOCTL-Memory-Read-Write.htmlExploit, Third Party Advisory, VDB Entry
- http://packetstormsecurity.com/files/162739/DELL-dbutil_2_3.sys-2.3-Arbitrary-Write-Privilege-Escalation.htmlExploit, Third Party Advisory, VDB Entry
- http://packetstormsecurity.com/files/162604/Dell-DBUtil_2_3.sys-IOCTL-Memory-Read-Write.htmlExploit, Third Party Advisory, VDB Entry
- http://packetstormsecurity.com/files/162739/DELL-dbutil_2_3.sys-2.3-Arbitrary-Write-Privilege-Escalation.htmlExploit, Third Party Advisory, VDB Entry
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-21551US Government Resource
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2021-21551?
How severe is CVE-2021-21551?
How do I fix CVE-2021-21551?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2021
- CVE-2021-21546Dell EMC NetWorker versions 18.x,19.x prior to 19.3.0.4 and …5.5
- CVE-2021-21547Dell EMC Unity, UnityVSA, and Unity XT versions prior to 5.0…6.7
- CVE-2021-21548 Dell EMC Unisphere for PowerMax versions before 9.1.0.27, D…7.4
- CVE-2021-21549Dell EMC XtremIO Versions prior to 6.3.3-8, contain a Cross-…8.8
- CVE-2021-2155Vulnerability in the Oracle One-to-One Fulfillment product o…4.3
- CVE-2021-21550Dell EMC PowerScale OneFS 8.1.0-9.1.0 contain an improper ne…6.7
- CVE-2021-21552Dell Wyse Windows Embedded System versions WIE10 LTSC 2019 a…8.8
- CVE-2021-21553Dell PowerScale OneFS versions 8.1.0-9.1.0 contain an Incorr…8.8
- CVE-2021-21554Dell PowerEdge R640, R740, R740XD, R840, R940, R940xa, MX740…6.7
- CVE-2021-21555Dell PowerEdge R640, R740, R740XD, R840, R940, R940xa, MX740…6.7
- CVE-2021-21556Dell PowerEdge R640, R740, R740XD, R840, R940, R940xa, MX740…6.7
- CVE-2021-21557Dell PowerEdge Server BIOS and select Dell Precision Rack BI…6.7
Are you affected by CVE-2021-21551?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST
