CVE-2021-3861

The RNDIS USB device class includes a buffer overflow vulnerability. Zephyr versions >= v2.6.0 contain Heap-based Buffer Overflow (CWE-122). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-hvfp-w4h8-gxvj

• CWE-122
• CWE-787

• http://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-hvfp-w4h8-gxvjExploit, Third Party Advisory
• http://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-hvfp-w4h8-gxvjExploit, Third Party Advisory

Published

Feb 7, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-38602PluXML 5.8.7 allows Article Editing stored XSS via Headline …4.8
• CVE-2021-38603PluXML 5.8.7 allows core/admin/profil.php stored XSS via the…4.8
• CVE-2021-38604In librt in the GNU C Library (aka glibc) through 2.34, sysd…7.5
• CVE-2021-38606reNgine through 0.5 relies on a predictable directory name.9.8
• CVE-2021-38607Crocoblock JetEngine before 2.6.1 allows XSS by remote authe…5.4
• CVE-2021-38608Incorrect Access Control in Tranquil WAPT Enterprise - befor…7.8
• CVE-2021-38611A command-injection vulnerability in the Image Upload functi…9.8
• CVE-2021-38612In NASCENT RemKon Device Manager 4.0.0.0, a Directory Traver…7.5
• CVE-2021-38613The assets/index.php Image Upload feature of the NASCENT Rem…9.8
• CVE-2021-38614Polipo through 1.1.1, when NDEBUG is used, allows a heap-bas…7.5
• CVE-2021-38615In Eigen NLP 3.10.1, a lack of access control on the /auth/v…8.1
• CVE-2021-38616In Eigen NLP 3.10.1, a lack of access control on the /auth/v…8.8