What is the CVSS score of CVE-2021-35031?

CVE-2021-35031 has a CVSS 3.1 base score of 8.0 (High). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Is there a patch available for CVE-2021-35031?

Yes, a patch is available for CVE-2021-35031. Update the affected software to the latest version immediately.

Gs1900 8 Firmware CVE-2021-35031

HIGH

OS Command Injection (CWE-78)

2021-12-28 security@zyxel.com.tw

Zyxel Command Injection Gs1900 8 Firmware Gs1900 8Hp Firmware Gs1900 10Hp Firmware Gs1900 16 Firmware Gs1900 24E Firmware Gs1900 24Ep Firmware Gs1900 24 Firmware Gs1900 24Hp Firmware Gs1900 24Hpv2 Firmware Gs1900 48 Firmware Gs1900 48Hp Firmware Gs1900 48Hpv2 Firmware Xgs1210 12 Firmware Xgs1250 12 Firmware

8.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.0 HIGH

AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVE Published

Dec 28, 2021 - 11:15 nvd

HIGH 8.0

DescriptionNVD

AnalysisAI

A vulnerability in the TFTP client of Zyxel GS1900 series firmware, XGS1210 series firmware, and XGS1250 series firmware, which could allow an authenticated LAN user to execute arbitrary OS commands. Rated high severity (CVSS 8.0), this vulnerability is low attack complexity. This OS Command Injection vulnerability could allow attackers to execute arbitrary operating system commands on the host.

Technical ContextAI

This vulnerability is classified as OS Command Injection (CWE-78), which allows attackers to execute arbitrary operating system commands on the host. A vulnerability in the TFTP client of Zyxel GS1900 series firmware, XGS1210 series firmware, and XGS1250 series firmware, which could allow an authenticated LAN user to execute arbitrary OS commands via the GUI of the vulnerable device. Affected products include: Zyxel Gs1900-8 Firmware, Zyxel Gs1900-8Hp Firmware, Zyxel Gs1900-10Hp Firmware, Zyxel Gs1900-16 Firmware, Zyxel Gs1900-24E Firmware.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Avoid passing user input to shell commands. Use language-specific APIs instead of shell execution. Apply strict input validation with allowlists.