ByteOS Network

Vulnerability Details :

CVE-2021-37289

Assigner-mitre

Assigner Org ID-8254265b-2729-46b6-b9e3-3dfca2d5bfca

Published At-22 Aug, 2022 | 14:34

Updated At-04 Aug, 2024 | 01:16

Insecure Permissions in administration interface in Planex MZK-DP150N 1.42 and 1.43 allows attackers to execute system command as root via etc_ro/web/syscmd.asp.

EPSS History

Score

Latest Score

N/A

Percentile

Latest Percentile

N/A

▼Common Vulnerabilities and Exposures (CVE)

cve.org

Assigner:mitre

Assigner Org ID:8254265b-2729-46b6-b9e3-3dfca2d5bfca

Published At:22 Aug, 2022 | 14:34

Updated At:04 Aug, 2024 | 01:16

▼CVE Numbering Authority (CNA)

Insecure Permissions in administration interface in Planex MZK-DP150N 1.42 and 1.43 allows attackers to execute system command as root via etc_ro/web/syscmd.asp.

Affected Products

Vendor

n/a

Product

n/a

Versions

Affected

Problem Types

Type	CWE ID	Description
text	N/A	n/a

Type: text

CWE ID: N/A

Description: n/a

References

Hyperlink	Resource
http://www.planex.co.jp/products/mzk-dp150n/	x_refsource_MISC
https://jvn.jp/en/vu/JVNVU98291763/	x_refsource_MISC
https://samy.link/blog/a-hidden-web-shell-in-the-plug-in-wireless-planex-mzk-dp150n	x_refsource_MISC

Hyperlink: http://www.planex.co.jp/products/mzk-dp150n/

Resource:

x_refsource_MISC

Hyperlink: https://jvn.jp/en/vu/JVNVU98291763/

Resource:

x_refsource_MISC

Hyperlink: https://samy.link/blog/a-hidden-web-shell-in-the-plug-in-wireless-planex-mzk-dp150n

Resource:

x_refsource_MISC

▼Authorized Data Publishers (ADP)

CVE Program Container

References

Hyperlink	Resource
http://www.planex.co.jp/products/mzk-dp150n/	x_refsource_MISC x_transferred
https://jvn.jp/en/vu/JVNVU98291763/	x_refsource_MISC x_transferred
https://samy.link/blog/a-hidden-web-shell-in-the-plug-in-wireless-planex-mzk-dp150n	x_refsource_MISC x_transferred

Hyperlink: http://www.planex.co.jp/products/mzk-dp150n/

Resource:

x_refsource_MISC

x_transferred

Hyperlink: https://jvn.jp/en/vu/JVNVU98291763/

Resource:

x_refsource_MISC

x_transferred

Hyperlink: https://samy.link/blog/a-hidden-web-shell-in-the-plug-in-wireless-planex-mzk-dp150n

Resource:

x_refsource_MISC

x_transferred

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:cve@mitre.org

Published At:22 Aug, 2022 | 15:15

Updated At:23 Aug, 2022 | 18:33

Insecure Permissions in administration interface in Planex MZK-DP150N 1.42 and 1.43 allows attackers to execute system command as root via etc_ro/web/syscmd.asp.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	7.2	HIGH	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Type: Primary

Version: 3.1

Base score: 7.2

Base severity: HIGH

Vector:

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CPE Matches

planex>>mzk-dp150n>>*

cpe:2.3:h:planex:mzk-dp150n:*:*:*:*:*:*:*:*

planex>>mzk-dp150n_firmware>>1.42

cpe:2.3:o:planex:mzk-dp150n_firmware:1.42:*:*:*:*:*:*:*

planex>>mzk-dp150n_firmware>>1.43

cpe:2.3:o:planex:mzk-dp150n_firmware:1.43:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-276	Primary	nvd@nist.gov

CWE ID: CWE-276

Type: Primary

Source: nvd@nist.gov

References

Hyperlink	Source	Resource
http://www.planex.co.jp/products/mzk-dp150n/	cve@mitre.org	Product Vendor Advisory
https://jvn.jp/en/vu/JVNVU98291763/	cve@mitre.org	Third Party Advisory
https://samy.link/blog/a-hidden-web-shell-in-the-plug-in-wireless-planex-mzk-dp150n	cve@mitre.org	Exploit Third Party Advisory

Hyperlink: http://www.planex.co.jp/products/mzk-dp150n/

Source: cve@mitre.org

Resource:

Product

Vendor Advisory

Hyperlink: https://jvn.jp/en/vu/JVNVU98291763/

Source: cve@mitre.org

Resource:

Third Party Advisory

Hyperlink: https://samy.link/blog/a-hidden-web-shell-in-the-plug-in-wireless-planex-mzk-dp150n

Source: cve@mitre.org

Resource:

Exploit

Third Party Advisory

Similar CVEs

8Records found

CVE-2019-16185

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.2||HIGH

EPSS-0.31% / 53.87%

7 Day CHG~0.00%

Published-09 Sep, 2019 | 20:25

Updated-05 Aug, 2024 | 01:10

In Limesurvey before 3.17.14, admin users can view, update, or delete reserved menu entries without proper permissions.

Vendor-limesurvey n/a

Product-limesurvey n/a

CWE ID-CWE-276

Incorrect Default Permissions

CVE-2022-41943

Matching Score-4

Assigner-GitHub, Inc.

View Details

Matching Score-4

Assigner-GitHub, Inc.

CVSS Score-9||CRITICAL

EPSS-0.04% / 11.72%

7 Day CHG~0.00%

Published-22 Nov, 2022 | 00:00

Updated-23 Apr, 2025 | 16:36

Incorrect default permissions found in Sourcegraph

sourcegraph is a code intelligence platform. As a site admin it was possible to execute arbitrary commands on Gitserver when the experimental `customGitFetch` feature was enabled. This experimental feature has now been disabled by default. This issue has been patched in version 4.1.0.

Vendor-sourcegraph sourcegraph

Product-sourcegraph sourcegraph

CWE ID-CWE-276

Incorrect Default Permissions

CVE-2018-17860

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.2||HIGH

EPSS-0.28% / 51.13%

7 Day CHG~0.00%

Published-26 Nov, 2019 | 14:11

Updated-05 Aug, 2024 | 10:54

Cloudera CDH has Insecure Permissions because ALL cannot be revoked.This affects 5.x through 5.15.1 and 6.x through 6.0.1.

Vendor-cloudera n/a

Product-cdh n/a

CWE ID-CWE-276

Incorrect Default Permissions

CVE-2020-8219

Matching Score-4

Assigner-HackerOne

View Details

Matching Score-4

Assigner-HackerOne

CVSS Score-7.2||HIGH

EPSS-1.73% / 81.69%

7 Day CHG~0.00%

Published-30 Jul, 2020 | 12:53

Updated-04 Aug, 2024 | 09:56

An insufficient permission check vulnerability exists in Pulse Connect Secure <9.1R8 that allows an attacker to change the password of a full administrator.

Vendor-n/a Ivanti Software Pulse Secure

Product-pulse_policy_secure policy_secure pulse_connect_secure connect_secure Pulse Connect Secure

CWE ID-CWE-280

Improper Handling of Insufficient Permissions or Privileges

CWE ID-CWE-276

Incorrect Default Permissions

CVE-2023-6302

Matching Score-4

Assigner-VulDB

View Details

Matching Score-4

Assigner-VulDB

CVSS Score-4.7||MEDIUM

EPSS-0.04% / 12.32%

7 Day CHG~0.00%

Published-27 Nov, 2023 | 00:00

Updated-29 Aug, 2024 | 20:35

CSZCMS File Manager Page templates permission

A vulnerability was found in CSZCMS 1.3.0 and classified as critical. Affected by this issue is some unknown functionality of the file \views\templates of the component File Manager Page. The manipulation leads to permission issues. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-246128. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Vendor-cskaza n/a

Product-cszcms CSZCMS

CWE ID-CWE-275

Not Available

CWE ID-CWE-276

Incorrect Default Permissions

CVE-2019-16186

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.2||HIGH

EPSS-0.37% / 57.86%

7 Day CHG~0.00%

Published-09 Sep, 2019 | 20:22

Updated-05 Aug, 2024 | 01:10

In Limesurvey before 3.17.14, admin users can access the plugin manager without proper permissions.

Vendor-limesurvey n/a

Product-limesurvey n/a

CWE ID-CWE-276

Incorrect Default Permissions

CVE-2021-22311

Matching Score-4

Assigner-Huawei Technologies

View Details

Matching Score-4

Assigner-Huawei Technologies

CVSS Score-7.2||HIGH

EPSS-0.15% / 35.64%

7 Day CHG~0.00%

Published-22 Mar, 2021 | 18:47

Updated-03 Aug, 2024 | 18:37

There is an improper permission assignment vulnerability in Huawei ManageOne product. Due to improper security hardening, the process can run with a higher privilege. Successful exploit could allow certain users to do certain operations with improper permissions. Affected product versions include: ManageOne versions 8.0.0, 8.0.1.

Vendor-n/a Huawei Technologies Co., Ltd.

Product-manageone ManageOne

CWE ID-CWE-276

Incorrect Default Permissions

CVE-2021-21736

Matching Score-4

Assigner-ZTE Corporation

View Details

Matching Score-4

Assigner-ZTE Corporation

CVSS Score-7.2||HIGH

EPSS-0.33% / 54.88%

7 Day CHG~0.00%

Published-10 Jun, 2021 | 11:28

Updated-03 Aug, 2024 | 18:23

A smart camera product of ZTE is impacted by a permission and access control vulnerability. Due to the defect of user permission management by the cloud-end app, users whose sharing permissions have been revoked can still control the camera, such as restarting the camera, restoring factory settings, etc.. This affects ZXHN HS562 V1.0.0.0B2.0000, V1.0.0.0B3.0000E

Vendor-n/a ZTE Corporation

Product-zxhn_hs562 zxhn_hs562_firmware ZXHN HS562

CWE ID-CWE-276

Incorrect Default Permissions

CVE-2021-37289

Credits

Vendors

Products

Metrics (CVSS)

Weaknesses

Attack Patterns

Solution/Workaround

References

EPSS History

Score

Latest Score

N/A

Percentile

Latest Percentile

N/A

Stakeholder-Specific Vulnerability Categorization (SSVC)

Affected Products

Affected

Problem Types

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

Affected Products

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History

Similar CVEs