VulnerabilityModified
CVE-2021-45917
The server-request receiver function of Shockwall system has an improper authentication vulnerability.
CRITICAL 9.0EPSS 0.45%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.45%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
The server-request receiver function of Shockwall system has an improper authentication vulnerability. An authenticated attacker of an agent computer within the local area network can use the local registry information to launch server-side request forgery (SSRF) attack on another agent computer, resulting in arbitrary code execution for controlling the system or disrupting service.
- CVSS 3.1
- 9.0 CRITICALCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- EPSS
- 0.45% probability · 38th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-287
- Affected
- sun moon jingyao/network computer terminal protection system firmware
- Source
- twcert@cert.org.tw
References
- https://www.twcert.org.tw/tw/cp-132-5433-77f6f-1.htmlThird Party Advisory
- https://www.twcert.org.tw/tw/cp-132-5433-77f6f-1.htmlThird Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.