CVE-2021-37911 Privilege escalation in EH600 OTA
Attackers on the local network can escalate privileges to execute arbitrary commands and access system directories on BenQ smart wireless conference projectors.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-37911?
CVE-2021-37911 is a high-severity vulnerability in BenQ EH600 OTA, published on 30 Aug 2021. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
The management interface of BenQ smart wireless conference projector does not properly control user's privilege. Attackers can access any system directory of this device through the interface and execute arbitrary commands if he enters the local subnetwork.
Weakness: CWE-269
Which versions are affected by CVE-2021-37911?
It affects 1 product.
Products include Benq Eh600 Firmware.
How do I fix CVE-2021-37911?
No fix has been published for CVE-2021-37911 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-37911 being exploited?
There is no known exploitation of CVE-2021-37911 in the wild and no public exploit code.
Sources
Also known as GHSA-39qh-hjm3-j4w3.