CVE-2021-37471 Denial of service in n/a
Attackers can cause denial of service on Cradlepoint IBR900-600 devices by exploiting a restricted shell escape sequence, blocking console and SSH access.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-37471?
CVE-2021-37471 is a high-severity denial of service vulnerability in n/a, published on 7 Nov 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Cradlepoint IBR900-600 devices running versions < 7.21.10 are vulnerable to a restricted shell escape sequence that provides an attacker the capability to simultaneously deny availability to the device's NetCloud Manager console, local console and SSH command-line.
Which versions are affected by CVE-2021-37471?
It affects 3 products.
Products include Cradlepoint Ibr600 Firmware, Cradlepoint Ibr600c Firmware, Cradlepoint Ibr900 Firmware.
How do I fix CVE-2021-37471?
No fix has been published for CVE-2021-37471 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2021-37471 being exploited?
There is no known exploitation of CVE-2021-37471 in the wild and no public exploit code.
Sources
Also known as GHSA-4jx7-9647-hpx8.