CVE-2021-23241

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

MERCUSYS Mercury X18G 1.0.5 devices allow Directory Traversal via ../ in conjunction with a loginLess or login.htm URI (for authentication bypass) to the web server, as demonstrated by the /loginLess/../../etc/passwd URI.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/BATTZION/MY_REQUEST/blob/master/Mercury%20Router%20Web%20Server%20Directory%20Traversal.mdExploit, Third Party Advisory
https://www.mercurycom.com.cn/product-521-1.htmlProduct, Vendor Advisory
https://www.mercusys.com/en/Vendor Advisory
https://github.com/BATTZION/MY_REQUEST/blob/master/Mercury%20Router%20Web%20Server%20Directory%20Traversal.mdExploit, Third Party Advisory
https://www.mercurycom.com.cn/product-521-1.htmlProduct, Vendor Advisory
https://www.mercusys.com/en/Vendor Advisory

Timeline

Published: Jan 7, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-232425.3MERCUSYS Mercury X18G 1.0.5 devices allow Directory Traversal via ../ to the UPnP server, as demonstrated by the /../../conf/template/uhttpd CVE-2021-232437.8In Oppo's battery application, the third-party SDK provides the function of loading a third-party Provider, which can be used.CVE-2021-232447.8ColorOS pregrant dangerous permissions to apps which are listed in a whitelist xml named default-grant-permissions.But some apps in whitelis CVE-2021-232467.5In ACE2 ColorOS11, the attacker can obtain the foreground package name through permission promotion, resulting in user information disclosur CVE-2021-232479.8A command injection vulerability found in quick game engine allows arbitrary remote code in quick app. Allows remote attacke0rs to gain arbi CVE-2021-232535.3Opera Mini for Android below 53.1 displays URL left-aligned in the address field. This allows a malicious attacker to craft a URL with a lon CVE-2021-232587.2Authenticated users with Administrator or Developer roles may execute OS commands by SPEL Expression in Spring beans. SPEL Expression does n CVE-2021-232597.2Authenticated users with Administrator or Developer roles may execute OS commands by Groovy Script which uses Groovy lib to render a webpage CVE-2021-23262.7Vulnerability in the Database Vault component of Oracle Database Server. Supported versions that are affected are 12.2.0.1 and 19c. Easily e CVE-2021-232605.4Authenticated users with Site roles may inject XSS scripts via file names that will execute in the browser for this and other users of the s CVE-2021-232614.9Authenticated administrators may override the system configuration file and cause a denial of service.CVE-2021-232627.2Authenticated administrators may modify the main YAML configuration file and load a Java class resulting in RCE.