PoC Index

CVE-2021-20138

HIGH 8.8EPSS 3.7%

An unauthenticated command injection vulnerability exists in multiple parameters in the Gryphon Tower router’s web interface at /cgi-bin/luci/rc. An unauthenticated remote attacker on the same network can execute commands as root on the device by sending a specially crafted malicious packet to the web interface.

CVSS v3.1
8.8 HIGHCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v2.0
8.3 HIGHAV:A/AC:L/Au:N/C:C/I:C/A:C
EPSS
3.70% chance of exploitation in the next 30 days, 89th percentile
Published
2021-12-09
Updated
2024-08-03

Proof-of-concept exploits (2)

References

Related