CVE-2021-38467

A specific function code receives a raw pointer supplied by the user and deallocates this pointer. The user can then control what memory regions will be freed and cause use-after-free condition.

• CWE-416

• https://us-cert.cisa.gov/ics/advisories/icsa-21-292-01Patch, Third Party Advisory, US Government Resource
• https://us-cert.cisa.gov/ics/advisories/icsa-21-292-01Patch, Third Party Advisory, US Government Resource

Published

Oct 22, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-38461The affected product uses a hard-coded blowfish key for encr…8.2
• CVE-2021-38462InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.…9.8
• CVE-2021-38463The affected product does not properly control the allocatio…8.1
• CVE-2021-38464InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.…7.4
• CVE-2021-38465The webinstaller is a Golang web server executable that enab…6.5
• CVE-2021-38466InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.…6.1
• CVE-2021-38468InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.…4.8
• CVE-2021-38469Many of the services used by the affected product do not spe…7.1
• CVE-2021-3847An unauthorized access to the execution of the setuid file w…7.8
• CVE-2021-38470InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.…9.1
• CVE-2021-38471There are multiple API function codes that permit data writi…9.1
• CVE-2021-38472InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.…4.7