CVE-2021-4039 Public exploit Critical · 9.8 EPSS 71.0%
A command injection vulnerability in the web interface of the Zyxel NWA-1100-NH firmware could allow an attacker to execute arbitrary OS commands on the device.
Zyxel · NWA1100-NH firmware
Summary
A command injection flaw in the web interface of the Zyxel NWA1100-NH firmware allows arbitrary operating system commands to be run on the device. An attacker needs network access to the web interface and requires no authentication or user interaction, since the vector shows the attack is network-reachable with low complexity and no privileges required.
Heading is the official description · CVE.org
Priority scorePatchfirst’s 0 to 100 ranking. It adds points for CISA KEV listing, ransomware use, EPSS, threat reports, public exploit code and CVSS. Every CVE page shows the breakdown. Breakdown
68.9 / 100
- Exploited
- Yes, in VulnCheck KEV
- Reports
- 0
- Tactics
- 0/15
Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
First seen exploited 3 months after disclosure. Public exploit code (Exploit-DB) appeared 49 days after disclosure.
- Disclosedday 0
- Public exploit codeExploit-DB+49 days
- First seen exploitedVulnCheck KEV evidence+3 mo
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
No techniques linkedNo ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.
What security researchers reported
Not named in any threat report yetAlso mentioned in 8 community threat pulses (AlienVault OTX)
Weaker evidencePulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.
- Proof Point Emerging Exploit list14 Dec 2022
- Recently discovered vulnerabilities are exploited by EnemyBot malware.28 Jun 2022
- Rapidly evolving IoT malware EnemyBot now targeting Content Management System servers and Android devices | AT&T Alien Labs31 May 2022
- EnemyBot Linux Botnet Now Exploits Web Server, Android and CMS Vulnerabilities31 May 2022
- Rapidly evolving IoT malware EnemyBot now targeting Content Management System servers and Android devices | AT&T Alien Labs31 May 2022
- Rapidly Evolving EnemyBot Botnet Adds New Exploits to Target CMS Servers and Android Devices30 May 2022
- 2 more on OTX