CVE-2021-35028

EUVD-2021-21675 · Published Sep 29, 2021

A command injection vulnerability in the CGI program of the Zyxel VPN2S firmware version 1.12 could allow an authenticated, local user to execute arbitrary OS commands.

Technologies

Zyxel Zywall Vpn2S FirmwareZyxel Zywall Vpn2S

Weaknesses

CWE-78

CVSS scores

v3.17.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
v2.07.2AV:L/AC:L/Au:N/C:C/I:C/A:C

MITRE ATT&CK

Inferred

Where this vulnerability fits in an attack

ReconImpact

Privilege Escalation

T1068Exploitation for Privilege Escalation

References

https://www.zyxel.com/support/Zyxel_security_advisory_for_directory_traversal_and_command_injection_vulnerabilities_of_VPN2S_Firewall.shtml

Potentially impacted assets

See if this affects your attack surface