CVE-2021-42324
High
Description
An issue was discovered on DCN (Digital China Networks) S4600-10P-SI devices before R0241.0470. Due to improper parameter validation in the console interface, it is possible for a low-privileged authenticated attacker to escape the sandbox environment and execute system commands as root via shell metacharacters in the capture command parameters. Command output will be shown on the Serial interface of the device. Exploitation requires both credentials and physical access.
SeverityHigh
CVSS7.4
Exploit probability—
ProductDcnglobal S4600-10p-si Firmware
PublishedApr 5, 2022
First seenApr 5, 2022
How to fix
Update
- dcnglobal s4600-10p-si_firmwarer0241.0470 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| dcnglobal s4600-10p-si_firmware | r0241.0370 ≤ v < r0241.0470 | r0241.0470 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.