First day on Intigriti: our agent harness found and proved a remote code execution bug, paid €3,000.

CVE-2021-35067

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

Meross MSG100 devices before 3.2.3 allow an attacker to replay the same data or similar data (e.g., an attacker who sniffs a Close message can transmit an acceptable Open message).

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

Affected software

No affected versions have been published.

Timeline

Published: Oct 7, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-350689.8Lack of null check while freeing the device information buffer in the Bluetooth HFP protocol can lead to a NULL pointer dereference in Snapd CVE-2021-350697.8Improper validation of data length received from DMA buffer can lead to memory corruption. in Snapdragon Auto, Snapdragon Compute, Snapdrago CVE-2021-35076.1A heap buffer overflow was found in the floppy disk emulator of QEMU up to 6.0.0 (including). It could occur in fdctrl_transfer_handler() in CVE-2021-350705.5RPM secure Stream can access any secure resource due to improper SMMU configuration and can lead to information disclosure in Snapdragon Ind CVE-2021-350715.5Possible buffer over read due to lack of size validation while copying data from DBR buffer to RX buffer and can lead to Denial of Service i CVE-2021-350727.8Possible buffer overflow due to improper validation of array index while processing external DIAG command in Snapdragon Auto, Snapdragon Con CVE-2021-350737.5Possible assertion due to improper validation of rank restriction field in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Sna CVE-2021-350747.8Possible integer overflow due to improper fragment datatype while calculating number of fragments in a request message in Snapdragon Auto, S CVE-2021-350757.8Possible null pointer dereference due to lack of WDOG structure validation during registration in Snapdragon Auto, Snapdragon Connectivity, CVE-2021-350767.5Possible null pointer dereference due to improper validation of RRC connection reconfiguration message in Snapdragon Auto, Snapdragon Comput CVE-2021-350777.8Possible use after free scenario in compute offloads to DSP while multiple calls spawn a dynamic process in Snapdragon Auto, Snapdragon Comp CVE-2021-350787.5Possible memory leak due to improper validation of certificate chain length while parsing server certificate chain in Snapdragon Auto, Snapd

CVE-2021-35067: High severity, CVSS 8.1 | Vulnix