CVE-2021-45428

TLR-2005KSH is affected by an incorrect access control vulnerability. THe PUT method is enabled so an attacker can upload arbitrary files including HTML and CGI formats.

CVSS v3.1 NVD

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0 NVD

7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS

56.93% chance of exploitation in the next 30 days, 99th percentile

Nuclei

critical · CWE-639

Published

2022-01-03

Updated

2024-08-04

Proof-of-concept exploits (2)

• http://packetstormsecurity.com/files/167101/TLR-2005KSH-Arbitrary-File-Upload.html
• projectforsix/CVE-2021-45428-Defacer0★ · 2024-07-30

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-45428.yaml

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/50931

Security advisories

• https://drive.google.com/file/d/1wM1SPOfB9mH2SES7cAmlysuI9fOpFB3F/view?usp=sharing

References

• CVE Record
• NVD entry