CVE-2021-33526 Privilege escalation in mbDIALUP <= 3.9R0.0

Q: What is CVE-2021-33526?

CVE-2021-33526 is a high-severity vulnerability in mbDIALUP, published on 2 Aug 2021. It can only be exploited from the same machine or local network, with no action from the victim.

Q: Is CVE-2021-33526 being exploited?

There is no known exploitation of CVE-2021-33526 in the wild and no public exploit code.

Q: How do I fix CVE-2021-33526?

No fix has been published for CVE-2021-33526 yet. Limit exposure of the affected software until one is available.

High 7.8 Published 2 Aug 2021 Updated 17 Sep 2024

A local attacker can escalate privileges to SYSTEM by sending a malicious command to the mbDIALUP service, leading to arbitrary code execution.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2021-33526?

CVE-2021-33526 is a high-severity vulnerability in mbDIALUP, published on 2 Aug 2021. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

In MB connect line mbDIALUP versions <= 3.9R0.0 a low privileged local attacker can send a command to the service running with NT AUTHORITY\SYSTEM instructing it to execute a malicous OpenVPN configuration resulting in arbitrary code execution with the privileges of the service.

Weakness: CWE-269

Which versions are affected by CVE-2021-33526?

It affects 1 product.

Products include Mbconnectline Mbdialup.

How do I fix CVE-2021-33526?

No fix has been published for CVE-2021-33526 yet. Limit exposure of the affected software until one is available.

Is CVE-2021-33526 being exploited?

There is no known exploitation of CVE-2021-33526 in the wild and no public exploit code.

CVE-2021-33527 OS Command Injection in mbDIALUP <= 3.9R0.0 Critical 9.8

Sources

Also known as GHSA-2992-6547-hhfp.