CVE-2021-33895

ETINET BACKBOX E4.09 and H4.09 mismanages password access control. When a user uses the User ID of the process running BBSV to login to the Backbox UI application, the system procedure (USER_AUTHENTICATE_) used for verifying the Password returns 0 (no error). The reason is that the user is not running the XYGate application. Hence, BBSV assumes the Password is correct. For H4.09, the affected version isT0954V04^AAO. For E4.09, the affected version is 22SEP2020. Note: If your current version is E4.10-16MAY2021 (version procedure T9999V04_16MAY2022_BPAKETI_10), a hotfix (FIXPAK-19OCT-2022) is available in version E4.10-19OCT2022. Resolution to CVE-2021-33895 in version E4.11-19OCT2022

• CWE-287

• https://etinet.com/products/backbox-virtual-tape-controller/Release Notes, Vendor Advisory
• https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=hpesbns04172en_usVendor Advisory
• https://etinet.com/products/backbox-virtual-tape-controller/Release Notes, Vendor Advisory
• https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=hpesbns04172en_usVendor Advisory

Published

Jun 25, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-33884An Unrestricted Upload of File with Dangerous Type vulnerabi…9.1
• CVE-2021-33885An Insufficient Verification of Data Authenticity vulnerabil…9.8
• CVE-2021-33886An improper sanitization of input vulnerability in B. Braun …8.8
• CVE-2021-33887Insufficient verification of data authenticity in Peloton TT…6.8
• CVE-2021-33889OpenThread wpantund through 2021-07-02 has a stack-based Buf…6.8
• CVE-2021-33894In Progress MOVEit Transfer before 2019.0.6 (11.0.6), 2019.1…8.8
• CVE-2021-33896Dino before 0.1.2 and 0.2.x before 0.2.1 allows Directory Tr…5.3
• CVE-2021-33897A buffer overflow in Synthesia before 10.7.5567, when a non-…5.5
• CVE-2021-33898In Invoice Ninja before 4.4.0, there is an unsafe call to un…8.1
• CVE-2021-33900While investigating DIRSTUDIO-1219 it was noticed that confi…7.5
• CVE-2021-33903In LCOS 10.40 to 10.42.0473-RU3 with SNMPv3 enabled on LANCO…8.8
• CVE-2021-33904In Accela Civic Platform through 21.1, the security/hostSign…6.1