CVE-2021-33527 OS Command Injection in mbDIALUP <= 3.9R0.0
Remote attackers can execute arbitrary code with SYSTEM privileges via crafted HTTP requests in mbDIALUP due to improper input validation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-33527?
CVE-2021-33527 is a critical command injection vulnerability in mbDIALUP, published on 2 Aug 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In MB connect line mbDIALUP versions <= 3.9R0.0 a remote attacker can send a specifically crafted HTTP request to the service running with NT AUTHORITY\SYSTEM that will not correctly validate the input. This can lead to an arbitrary code execution with the privileges of the service.
Weakness: CWE-20
Which versions are affected by CVE-2021-33527?
It affects 1 product.
Products include Mbconnectline Mbdialup.
How do I fix CVE-2021-33527?
No fix has been published for CVE-2021-33527 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2021-33527 being exploited?
There is no known exploitation of CVE-2021-33527 in the wild and no public exploit code.
Other vulnerabilities in mbDIALUP
Sources
Also known as GHSA-hrmp-939q-g4mq.