CVE-2021-20143

An unauthenticated command injection vulnerability exists in the parameters of operation 48 in the controller_server service on Gryphon Tower routers. An unauthenticated remote attacker on the same network can execute commands as root on the device by sending a specially crafted malicious packet to the controller_server service on port 9999.

Score

CVSS 3.1 8.8 High

Status

Modified - vulnreport@tenable.com

Published

2021-12-09

Last modified

2024-08-03

Weaknesses

CWE-78

Affected products

• Gryphon Tower Firmware (Gryphonconnect)

References

• https://www.tenable.com/security/research/tra-2021-51