CVE-2021-26758

Privilege Escalation in LiteSpeed Technologies OpenLiteSpeed web server version 1.7.8 allows attackers to gain root terminal access and execute commands on the host system.

CVSS v3.1

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0

9.0 HIGHAV:N/AC:L/Au:S/C:C/I:C/A:C

EPSS

2.71% chance of exploitation in the next 30 days, 85th percentile

Published

2021-04-07

Updated

2024-08-03

Proof-of-concept exploits (3)

• https://docs.unsafe-inline.com/0day/openlitespeed-web-server-1.7.8-command-injection-to-p…
• litespeedtech/openlitespeed/issues/217
• https://www.exploit-db.com/exploits/49556

References

• CVE Record
• NVD entry

Related

• CVE-2018-19791
• CVE-2018-19792
• CVE-2021-26754
• CVE-2021-26762
• CVE-2021-26753
• CVE-2021-26764