Wireless 1410 Gateway Firmware
CVE-2021-42540
HIGH
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionNVD
The affected product is vulnerable to a unsanitized extract folder for system configuration. A low-privileged user can leverage this logic to overwrite the settings and other key functionality.
AnalysisAI
The affected product is vulnerable to a unsanitized extract folder for system configuration. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.
Technical ContextAI
This vulnerability is classified under CWE-123. The affected product is vulnerable to a unsanitized extract folder for system configuration. A low-privileged user can leverage this logic to overwrite the settings and other key functionality. Affected products include: Emerson Wireless 1410 Gateway Firmware, Emerson Wireless 1410D Gateway Firmware, Emerson Wireless 1420 Gateway Firmware.
RemediationAI
A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.
The affected product is vulnerable to directory traversal due to mishandling of provided backup folder structure. Rated
The affected product is vulnerable to a missing permission validation on system backup restore, which could lead to acco
The affected product is vulnerable to a parameter injection via passphrase, which enables the attacker to supply uncontr
The affected product is vulnerable to improper input validation in the restore file. Rated high severity (CVSS 8.8), thi
The affected product is vulnerable to a disclosure of peer username and password by allowing all users access to read gl
Same weakness CWE-123 – Write-what-where Condition
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today