Details of VAR-202102-1655

ID

VAR-202102-1655

CVE

CVE-2021-33964

TITLE

China Mobile An Lianbao WF-1 Command injection vulnerability in router

Trust: 0.8

sources: JVNDB: JVNDB-2021-017844

DESCRIPTION

China Mobile An Lianbao WF-1 V1.0.1 router provides a web interface /api/ZRRuleFilter/set_firewall_level which receives parameters by POST request, and the parameter firewall_level has a command injection vulnerability. An attacker can use the vulnerability to execute remote commands. (DoS) It may be in a state. Anlianbao WT-1 is a 4G router that integrates wired and wireless router access, and secure Internet access. An Lianbao WF-1 router has a command execution vulnerability, which can be exploited by attackers to gain server management rights

Trust: 2.16

sources: NVD: CVE-2021-33964 // JVNDB: JVNDB-2021-017844 // CNVD: CNVD-2021-03520

IOT TAXONOMY

category:

['IoT', 'Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2021-03520

AFFECTED PRODUCTS

vendor:	chinamobile	model:	an lianbao wf-1	scope:	eq	version:	1.0.1	Trust: 1.0
vendor:	mobile	model:	an lianbao wf-1	scope:	eq	version:	-	Trust: 0.8
vendor:	mobile	model:	an lianbao wf-1	scope:	eq	version:	an lianbao wf-1 firmware 1.0.1	Trust: 0.8
vendor:	mobile internet of things	model:	an lianbao	scope:	eq	version:	v1.0.1	Trust: 0.6

sources: CNVD: CNVD-2021-03520 // JVNDB: JVNDB-2021-017844 // NVD: CVE-2021-33964

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2021-33964
value:	HIGH
Trust: 1.0
NVD:	CVE-2021-33964
value:	HIGH
Trust: 0.8
CNVD:	CNVD-2021-03520
value:	MEDIUM
Trust: 0.6
CNNVD:	CNNVD-202201-1505
value:	HIGH
Trust: 0.6

nvd@nist.gov:	CVE-2021-33964
severity:	MEDIUM
baseScore:	6.5
vectorString:	AV:N/AC:L/AU:S/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	8.0
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
CNVD:	CNVD-2021-03520
severity:	MEDIUM
baseScore:	6.5
vectorString:	AV:A/AC:H/AU:S/C:C/I:C/A:C
accessVector:	ADJACENT_NETWORK
accessComplexity:	HIGH
authentication:	SINGLE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	2.5
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6

nvd@nist.gov:	CVE-2021-33964
baseSeverity:	HIGH
baseScore:	8.8
vectorString:	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	2.8
impactScore:	5.9
version:	3.1
Trust: 1.0
NVD:	CVE-2021-33964
baseSeverity:	HIGH
baseScore:	8.8
vectorString:	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: CNVD: CNVD-2021-03520 // JVNDB: JVNDB-2021-017844 // CNNVD: CNNVD-202201-1505 // NVD: CVE-2021-33964

PROBLEMTYPE DATA

problemtype:	CWE-77	Trust: 1.0
problemtype:	Command injection (CWE-77) [NVD evaluation ]	Trust: 0.8

sources: JVNDB: JVNDB-2021-017844 // NVD: CVE-2021-33964

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202201-1505

TYPE

command injection

Trust: 0.6

sources: CNNVD: CNNVD-202201-1505

PATCH

title:

HOME-China Mobile IoT

url:

https://iot.10086.cn/?l=en-us

Trust: 0.8

sources: JVNDB: JVNDB-2021-017844

EXTERNAL IDS

db:	NVD	id:	CVE-2021-33964	Trust: 3.2
db:	CNVD	id:	CNVD-2021-03520	Trust: 3.0
db:	JVNDB	id:	JVNDB-2021-017844	Trust: 0.8
db:	CNNVD	id:	CNNVD-202201-1505	Trust: 0.6

sources: CNVD: CNVD-2021-03520 // JVNDB: JVNDB-2021-017844 // CNNVD: CNNVD-202201-1505 // NVD: CVE-2021-33964

REFERENCES

url:	https://www.cnvd.org.cn/flaw/show/cnvd-2021-03520	Trust: 2.4
url:	https://github.com/pokerfacett/my_cve_credit/blob/master/china%20mobile%20an%20lianbao%20wf-1%20router%20command%20injection11.md	Trust: 1.6
url:	http://iot.10086.cn/?l=en-us	Trust: 1.6
url:	https://www.ebuy7.com/item/china-mobile-wireless-router-qualcomm-qiki-wifi6-routing-mesh-network-home-5g-dual-frequency-double-gigabit-port-wall-wall-high-speed-%e2%80%8b%e2%80%8bhigh-power-enhanced-dormitory-students-an-lianbao-wf-1-628692180620	Trust: 1.6
url:	https://nvd.nist.gov/vuln/detail/cve-2021-33964	Trust: 1.4

sources: JVNDB: JVNDB-2021-017844 // CNNVD: CNNVD-202201-1505 // NVD: CVE-2021-33964

SOURCES

db:	CNVD	id:	CNVD-2021-03520
db:	JVNDB	id:	JVNDB-2021-017844
db:	CNNVD	id:	CNNVD-202201-1505
db:	NVD	id:	CVE-2021-33964

LAST UPDATE DATE

2024-08-14T13:23:43.638000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2021-03520	date:	2021-01-16T00:00:00
db:	JVNDB	id:	JVNDB-2021-017844	date:	2023-02-20T02:44:00
db:	CNNVD	id:	CNNVD-202201-1505	date:	2022-01-26T00:00:00
db:	NVD	id:	CVE-2021-33964	date:	2022-01-24T18:49:42.787

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2021-03520	date:	2021-02-20T00:00:00
db:	JVNDB	id:	JVNDB-2021-017844	date:	2023-02-20T00:00:00
db:	CNNVD	id:	CNNVD-202201-1505	date:	2022-01-18T00:00:00
db:	NVD	id:	CVE-2021-33964	date:	2022-01-18T12:15:08.190