CVE-2021-38111

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

The DEF CON 27 badge allows remote attackers to exploit a buffer overflow by sending an oversized packet via the NFMI (Near Field Magnetic Induction) protocol.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-120

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://defcon.org/html/defcon-29/dc-29-speakers.html#kintighExploit, Third Party Advisory
https://github.com/skintigh/defcon27_badge_sdr
https://defcon.org/html/defcon-29/dc-29-speakers.html#kintighExploit, Third Party Advisory
https://github.com/skintigh/defcon27_badge_sdr

Timeline

Published: Aug 4, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-381128.8In the Amazon AWS WorkSpaces client 3.0.10 through 3.1.8 on Windows, argument injection in the workspaces:// URI handler can lead to remote CVE-2021-381135.4In addBouquet in js/bqe.js in OpenWebif (aka e2openplugin-OpenWebif) through 1.4.7, inserting JavaScript into the Add Bouquet feature of the CVE-2021-381145.5libavcodec/dnxhddec.c in FFmpeg 4.4 does not check the return value of the init_vlc function, a similar issue to CVE-2013-0868.CVE-2021-381156.5read_header_tga in gd_tga.c in the GD Graphics Library (aka LibGD) through 2.3.2 allows remote attackers to cause a denial of service (out-o CVE-2021-381168.8Possible Elevation of Privilege Vulnerability in iManager has been discovered in OpenText™ iManager. This impacts all versions before 3.2.5 CVE-2021-381179.8Possible Command injection Vulnerability in iManager has been discovered in OpenText™ iManager 3.2.4.0000.CVE-2021-381187.8Possible improper input validation Vulnerability in iManager has been discovered in OpenText™ iManager 3.2.4.0000.CVE-2021-381196.1Possible Reflected Cross-Site Scripting (XSS) Vulnerability in iManager has been discovered in OpenText™ iManager 3.2.4.0000.CVE-2021-38126.1adminlte is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2021-381207.2A vulnerability identified in Advance Authentication that allows bash command Injection in administrative controlled functionality of backup CVE-2021-381218.8Insufficient or weak TLS protocol version identified in Advance authentication client server communication when specific service is accessed CVE-2021-381228.2A Cross-Site Scripting vulnerable identified in NetIQ Advance Authentication that impacts the server functionality and disclose sensitive in