CVE-2021-29645 Privilege escalation in n/a
A local attacker can exploit a vulnerability in the Hitachi JP1/IT Desktop Management 2 Agent to execute arbitrary code and escalate privileges.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-29645?
CVE-2021-29645 is a high-severity vulnerability in n/a, published on 12 Oct 2021. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Hitachi JP1/IT Desktop Management 2 Agent 9 through 12 calls the SendMessageTimeoutW API with arbitrary arguments via a local pipe, leading to a local privilege escalation vulnerability. An attacker who exploits this issue could execute arbitrary code on the local system.
Which versions are affected by CVE-2021-29645?
It affects 14 products.
Products include Hitachi It Operations Director, Hitachi Job Management Partner 1\/It Desktop Management-Manager, Hitachi Job Management Partner 1\/It Desktop Management 2-Manager, Hitachi Job Management Partner 1\/Remote Control Agent, Hitachi Job Management Partner 1\/Software Distribution Client, Hitachi Job Management Partner 1\/Software Distribution Manager and 8 more.
How do I fix CVE-2021-29645?
No fix has been published for CVE-2021-29645 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-29645 being exploited?
There is no known exploitation of CVE-2021-29645 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-4v64-3g6p-jfw6.