CVE-2021-20139

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

An unauthenticated command injection vulnerability exists in the parameters of operation 3 in the controller_server service on Gryphon Tower routers. An unauthenticated remote attacker on the same network can execute commands as root on the device by sending a specially crafted malicious packet to the controller_server service on port 9999.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
n/a	Gryphon Tower router	<= 04.0004.12 (Current)

References

https://www.tenable.com/security/research/tra-2021-51Exploit, Vendor Advisory
https://www.tenable.com/security/research/tra-2021-51Exploit, Vendor Advisory

Timeline

Published: Dec 9, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-20144.9Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: PAM Auth Plugin). Supported versions that are affected are 5.7 CVE-2021-201408.8An unauthenticated command injection vulnerability exists in the parameters of operation 10 in the controller_server service on Gryphon Towe CVE-2021-201418.8An unauthenticated command injection vulnerability exists in the parameters of operation 32 in the controller_server service on Gryphon Towe CVE-2021-201428.8An unauthenticated command injection vulnerability exists in the parameters of operation 41 in the controller_server service on Gryphon Towe CVE-2021-201438.8An unauthenticated command injection vulnerability exists in the parameters of operation 48 in the controller_server service on Gryphon Towe CVE-2021-201448.8An unauthenticated command injection vulnerability exists in the parameters of operation 49 in the controller_server service on Gryphon Towe CVE-2021-201457.5Gryphon Tower routers contain an unprotected openvpn configuration file which can grant attackers access to the Gryphon homebound VPN networ CVE-2021-201469.8An unprotected ssh private key exists on the Gryphon devices which could be used to achieve root access to a server affiliated with Gryphon'CVE-2021-201475.3ManageEngine ADSelfService Plus below build 6116 contains an observable response discrepancy in the UMCP operation of the ChangePasswordAPI.CVE-2021-201484.3ManageEngine ADSelfService Plus below build 6116 stores the password policy file for each domain under the html/ web root with a predictable CVE-2021-201499.8Trendnet AC2600 TEW-827DRU version 2.08B01 does not have sufficient access controls for the WAN interface. The default iptables ruleset for CVE-2021-20158.2Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Worklist). Supported versions that are affected are 12.2