Network Attached Storage on LG N1T1*** 10124 devices allows an unauthenticated attacker to gain root access via OS command injection in the en/ajp/plugins/access.ssh/checkInstall.php destServer parameter.
References
Link | Resource |
---|---|
https://www.lg.com/uk/support/product/lg-N1T1DD1 | Product Vendor Advisory |
https://www.lg.com/us/burners-drives/lg-N1T1-network-attached-storage | Product Vendor Advisory |
https://zerosecuritypenetrationtesting.com/?page_id=306 | Exploit Third Party Advisory URL Repurposed |
Configurations
Configuration 1 (hide)
AND |
|
History
14 Feb 2024, 01:17
Type | Values Removed | Values Added |
---|---|---|
References | (MISC) https://zerosecuritypenetrationtesting.com/?page_id=306 - Exploit, Third Party Advisory, URL Repurposed |
Information
Published : 2021-08-24 13:15
Updated : 2024-02-28 18:28
NVD link : CVE-2021-38306
Mitre link : CVE-2021-38306
CVE.ORG link : CVE-2021-38306
JSON object : View
Products Affected
lg
- n1t1_firmware
- n1t1dd1
- n1t1
CWE
CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')