CVE-2021-33205
Last modified
CVE-2021-33205 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. Western Digital EdgeRover before 0.25 has an escalation of privileges vulnerability where a low privileged user could load malicious content into directories with higher privileges, because of how Node.js is used. An attacker can gain admin privileges and carry out malicious activities such as creating a fake library and stealing user credentials.. EPSS estimates a 0.97% chance of exploitation in the next 30 days.
Description
Western Digital EdgeRover before 0.25 has an escalation of privileges vulnerability where a low privileged user could load malicious content into directories with higher privileges, because of how Node.js is used. An attacker can gain admin privileges and carry out malicious activities such as creating a fake library and stealing user credentials.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Westerndigital | Edgerover | < 0.25 |
References
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2021-33205?
How severe is CVE-2021-33205?
How do I fix CVE-2021-33205?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2021
- CVE-2021-33198In Go before 1.15.13 and 1.16.x before 1.16.5, there can be …7.5
- CVE-2021-33199In Expression Engine before 6.0.3, addonIcon in Addons/file/…9.8
- CVE-2021-3320Type Confusion in 802154 ACK Frames Handling. Zephyr version…7.5
- CVE-2021-33200kernel/bpf/verifier.c in the Linux kernel through 5.12.7 enf…7.8
- CVE-2021-33203Django before 2.2.24, 3.x before 3.1.12, and 3.2.x before 3.…4.9
- CVE-2021-33204In the pg_partman (aka PG Partition Manager) extension befor…9.8
- CVE-2021-33207The HTTP client in MashZone NextGen through 10.7 GA deserial…9.8
- CVE-2021-33208The "Register an Ehcache Configuration File" admin feature i…7.2
- CVE-2021-33209An issue was discovered in Fimer Aurora Vision before 2.97.1…5.3
- CVE-2021-3321Integer Underflow in Zephyr in IEEE 802154 Fragment Reassemb…8.8
- CVE-2021-33210An issue was discovered in Fimer Aurora Vision before 2.97.1…4.3
- CVE-2021-33211A Directory Traversal vulnerability in the Unzip feature in …6.5
Are you affected by CVE-2021-33205?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST