CVE-2021-23241
Severity CVSS v4.0:
Pending analysis
Type:
CWE-22
Path Traversal
Publication date:
07/01/2021
Last modified:
12/01/2021
Description
MERCUSYS Mercury X18G 1.0.5 devices allow Directory Traversal via ../ in conjunction with a loginLess or login.htm URI (for authentication bypass) to the web server, as demonstrated by the /loginLess/../../etc/passwd URI.
Impact
Base Score 3.x
5.30
Severity 3.x
MEDIUM
Base Score 2.0
5.00
Severity 2.0
MEDIUM
Vulnerable products and versions
CPE | From | Up to |
---|---|---|
cpe:2.3:o:mercusys:mercury_x18g_firmware:1.0.5:*:*:*:*:*:*:* | ||
cpe:2.3:h:mercusys:mercury_x18g:-:*:*:*:*:*:*:* |
To consult the complete list of CPE names with products and versions, see this page