CVE-2021-31573

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

In Config Manager, there is a possible command injection due to improper input validation. This could lead to remote escalation of privilege from a proximal attacker with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: A20210009; Issue ID: OSBNB00123234.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77

Affected software

Vendor	Product	Versions
MediaTek, Inc.	EN7528, EN7580	Linux SDK versions less than TLM7.3.275.0-82

References

https://corp.mediatek.com/product-security-acknowledgementsVendor Advisory
https://corp.mediatek.com/product-security-acknowledgementsVendor Advisory

Timeline

Published: Feb 6, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-315749.8In Config Manager, there is a possible command injection due to improper input validation. This could lead to remote escalation of privilege CVE-2021-315759.8In Config Manager, there is a possible command injection due to improper input validation. This could lead to remote escalation of privilege CVE-2021-315767.5In Boa, there is a possible information disclosure due to a missing permission check. This could lead to remote information disclosure to a CVE-2021-315779.8In Boa, there is a possible escalation of privilege due to a missing permission check. This could lead to remote escalation of privilege fro CVE-2021-315789.8In Boa, there is a possible escalation of privilege due to a stack buffer overflow. This could lead to remote escalation of privilege from a CVE-2021-315799.8Akkadian Provisioning Manager Engine (PME) ships with a hard-coded credential, akkadianuser:haakkadianpassword. This issue was resolved in A CVE-2021-315809.8The restricted shell provided by Akkadian Provisioning Manager Engine (PME) can be bypassed by switching the OpenSSH channel from `shell` to CVE-2021-315814.4The restricted shell provided by Akkadian Provisioning Manager Engine (PME) can be escaped by abusing the 'Edit MySQL Configuration' command CVE-2021-315835.4Sipwise C5 NGCP WWW Admin version 3.6.7 up to and including platform version NGCP CE 3.0 has multiple authenticated stored and reflected XSS CVE-2021-315848.8Sipwise C5 NGCP www_csc version 3.6.4 up to and including platform NGCP CE mr3.8.13 allows call/click2dial CSRF attacks for actions with adm CVE-2021-315856.7Accellion Kiteworks before 7.3.1 allows a user with Admin privileges to escalate their privileges by generating SSH passwords that allow loc CVE-2021-315868.8Accellion Kiteworks before 7.4.0 allows an authenticated user to perform SQL Injection via LDAPGroup Search.