CVE-2021-23241

Severity CVSS v4.0:
Pending analysis
Type:
CWE-22 Path Traversal
Publication date:
07/01/2021
Last modified:
12/01/2021

Description

MERCUSYS Mercury X18G 1.0.5 devices allow Directory Traversal via ../ in conjunction with a loginLess or login.htm URI (for authentication bypass) to the web server, as demonstrated by the /loginLess/../../etc/passwd URI.

Vulnerable products and versions

CPE From Up to
cpe:2.3:o:mercusys:mercury_x18g_firmware:1.0.5:*:*:*:*:*:*:*
cpe:2.3:h:mercusys:mercury_x18g:-:*:*:*:*:*:*:*