What is the CVSS score of CVE-2021-29645?

CVE-2021-29645 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Jp1 It Desktop Management 2 Manager CVE-2021-29645

HIGH

2021-10-12 cve@mitre.org

Privilege Escalation RCE Jp1 It Desktop Management 2 Manager Jp1 It Desktop Management 2 Operations Director Job Management Partner 1 It Desktop Management 2 Manager Jp1 It Desktop Management Manager Job Management Partner 1 It Desktop Management Manager Jp1 Netm Dm Manager Jp1 Netm Dm Client Job Management Partner 1 Software Distribution Manager Job Management Partner 1 Software Distribution Client It Operations Director Job Management Partner 1 Remote Control Agent Jp1 Netm Dm Client Remote Control Feature Jp1 Netm Remote Control Feature Jp1 Remote Control Feature Hitachi

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVE Published

Oct 12, 2021 - 19:15 nvd

HIGH 7.8

DescriptionNVD

AnalysisAI

Technical ContextAI

Hitachi JP1/IT Desktop Management 2 Agent 9 through 12 calls the SendMessageTimeoutW API with arbitrary arguments via a local pipe, leading to a local privilege escalation vulnerability. An attacker who exploits this issue could execute arbitrary code on the local system. Affected products include: Hitachi It Operations Director, Hitachi Job Management Partner 1\/It Desktop Management-Manager, Hitachi Job Management Partner 1\/It Desktop Management 2-Manager, Hitachi Job Management Partner 1\/Remote Control Agent, Hitachi Job Management Partner 1\/Software Distribution Client. Version information: through 12.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.