CVE-2021-46704
Last modified
CVE-2021-46704 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. In GenieACS 1.2.x before 1.2.8, the UI interface API is vulnerable to unauthenticated OS command injection via the ping host argument (lib/ui/api.ts and lib/ping.ts). The vulnerability arises from insufficient input validation combined with a missing authorization check.. EPSS estimates a 21.90% chance of exploitation in the next 30 days.
Description
In GenieACS 1.2.x before 1.2.8, the UI interface API is vulnerable to unauthenticated OS command injection via the ping host argument (lib/ui/api.ts and lib/ping.ts). The vulnerability arises from insufficient input validation combined with a missing authorization check.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Genieacs | Genieacs | >= 1.2.0, < 1.2.8 |
References
- https://github.com/genieacs/genieacs/commit/7f295beeecc1c1f14308a93c82413bb334045af6Patch, Third Party Advisory
- https://github.com/genieacs/genieacs/releases/tag/v1.2.8Release Notes, Third Party Advisory
- https://github.com/genieacs/genieacs/commit/7f295beeecc1c1f14308a93c82413bb334045af6Patch, Third Party Advisory
- https://github.com/genieacs/genieacs/releases/tag/v1.2.8Release Notes, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2021-46704?
How severe is CVE-2021-46704?
How do I fix CVE-2021-46704?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2021
- CVE-2021-46687JFrog Artifactory prior to version 7.31.10 and 6.23.38 is vu…4.9
- CVE-2021-46699A vulnerability has been identified in Simcenter Femap (All …7.8
- CVE-2021-46700In libsixel 1.8.6, sixel_encoder_output_without_macro (calle…6.5
- CVE-2021-46701PreMiD 2.2.0 allows unintended access via the websocket tran…6.5
- CVE-2021-46702Tor Browser 9.0.7 on Windows 10 build 10586 is vulnerable to…5.5
- CVE-2021-46703In the IsolatedRazorEngine component of Antaris RazorEngine …9.8
- CVE-2021-46705A Insecure Temporary File vulnerability in grub-once of grub…4.4
- CVE-2021-46708The swagger-ui-dist package before 4.1.3 for Node.js could a…6.1
- CVE-2021-46709phpLiteAdmin through 1.9.8.2 allows XSS via the index.php ne…6.1
- CVE-2021-46740The device authentication service module has a defect vulner…7.5
- CVE-2021-46741The basic framework and setting module have defects, which w…7.5
- CVE-2021-46742The multi-window module has a vulnerability of unauthorized …9.1
Are you affected by CVE-2021-46704?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST