CVE-2021-33162

HighCVSS 8.4/10Last modified Jun 17, 2026

Description

Improper access control in some Intel(R) Ethernet Adapters and Intel(R) Ethernet Controller I225 Manageability firmware may allow an authenticated user to potentially enable escalation of privilege via local access.

Metrics

CVSS 3.1 8.4/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H

Weakness enumeration

CWE-284

Affected software

No affected versions have been published.

Timeline

Published
Feb 23, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2021

CVE-2021-331646.7Improper access control in BIOS firmware for some Intel(R) NUCs before version INWHL357.0046 may allow a privileged user to potentially enabCVE-2021-331665.5Incorrect default permissions for the Intel(R) RXT for Chromebook application, all versions, may allow an authenticated user to potentially CVE-2021-33178.8KLog Server through 2.4.1 allows authenticated command injection. async.php calls shell_exec() on the original value of the source parameterCVE-2021-331757.5EMQ X Broker versions prior to 4.2.8 are vulnerable to a denial of service attack as a result of excessive memory consumption due to the hanCVE-2021-331767.5VerneMQ MQTT Broker versions prior to 1.12.0 are vulnerable to a denial of service attack as a result of excessive memory consumption due toCVE-2021-331778.8The Bulk Modifications functionality in Nagios XI versions prior to 5.8.5 is vulnerable to SQL injection. Exploitation requires the maliciouCVE-2021-331786.5The Manage Backgrounds functionality within NagVis versions prior to 1.9.29 is vulnerable to an authenticated path traversal vulnerability. CVE-2021-331796.1The general user interface in Nagios XI versions prior to 5.8.4 is vulnerable to authenticated reflected cross-site scripting. An authenticaCVE-2021-33186.1attach/ajax.php in DzzOffice through 2.02.1 allows XSS via the editorid parameter.CVE-2021-331809.8Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in cgi component in Synology Media ServerCVE-2021-331819.1Server-Side Request Forgery (SSRF) vulnerability in webapi component in Synology Video Station before 2.4.10-1632 allows remote authenticateCVE-2021-331824.3Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in PDF Viewer component in Synology DiskStation