CVE-2021-44124
Last modified
CVE-2021-44124 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. Hiby Music Hiby OS R3 Pro 1.5 and 1.6 is vulnerable to Directory Traversal. The HTTP Server does not have enough input data sanitization when shown data from SD Card, an attacker can navigate through the device's File System over HTTP.. EPSS estimates a 1.86% chance of exploitation in the next 30 days.
Description
Hiby Music Hiby OS R3 Pro 1.5 and 1.6 is vulnerable to Directory Traversal. The HTTP Server does not have enough input data sanitization when shown data from SD Card, an attacker can navigate through the device's File System over HTTP.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Hiby | R3 Pro Firmware | 1.5 |
| Hiby | R3 Pro Firmware | 1.6 |
References
- https://github.com/feric/Findings/tree/main/Hiby/Web%20Server/Path%20TraversalExploit, Third Party Advisory
- https://github.com/vext01/hiby-issues/issues/9#issuecomment-907891626Exploit, Third Party Advisory
- https://github.com/feric/Findings/tree/main/Hiby/Web%20Server/Path%20TraversalExploit, Third Party Advisory
- https://github.com/vext01/hiby-issues/issues/9#issuecomment-907891626Exploit, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2021-44124?
How severe is CVE-2021-44124?
How do I fix CVE-2021-44124?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2021
- CVE-2021-44118SPIP 4.0.0 is affected by a Cross Site Scripting (XSS) vulne…5.4
- CVE-2021-4412The WP Prayer plugin for WordPress is vulnerable to Cross-Si…4.3
- CVE-2021-44120SPIP 4.0.0 is affected by a Cross Site Scripting (XSS) vulne…5.4
- CVE-2021-44121Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
- CVE-2021-44122SPIP 4.0.0 is affected by a Cross Site Request Forgery (CSRF…8.8
- CVE-2021-44123SPIP 4.0.0 is affected by a remote command execution vulnera…8.8
- CVE-2021-44127In DLink DAP-1360 F1 firmware version <=v6.10 in the "webupg…9.8
- CVE-2021-4413The Process Steps Template Designer plugin for WordPress is …4.3
- CVE-2021-44132A command injection vulnerability in the function formImport…7.8
- CVE-2021-44135pagekit all versions, as of 15-10-2021, is vulnerable to SQL…9.8
- CVE-2021-44138There is a Directory traversal vulnerability in Caucho Resin…7.5
- CVE-2021-44139Sentinel 1.8.2 is vulnerable to Server-side request forgery …7.5
Are you affected by CVE-2021-44124?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST