CVE-2021-38459

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The data of a network capture of the initial handshake phase can be used to authenticate at a SYSDBA level. If a specific .exe is not restarted often, it is possible to access the needed handshake packets between admin/client connections. Using the SYSDBA permission, an attacker can change user passwords or delete the database.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-294

Affected software

No affected versions have been published.

Timeline

Published: Oct 22, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-38468.8firefly-iii is vulnerable to Unrestricted Upload of File with Dangerous Type CVE-2021-384607.5A path traversal vulnerability in the Moxa MXview Network Management software Versions 3.x to 3.2.2 may allow an attacker to create or overw CVE-2021-384618.2The affected product uses a hard-coded blowfish key for encryption/decryption processes. The key can be easily extracted from binaries.CVE-2021-384629.8InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 does not enforce an efficient password policy. This may allow an attacke CVE-2021-384638.1The affected product does not properly control the allocation of resources. A user may be able to allocate unlimited memory buffers using AP CVE-2021-384647.4InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 have inadequate encryption strength, which may allow an attacker to inte CVE-2021-384656.5The webinstaller is a Golang web server executable that enables the generation of an Auvesy image agent. Resource consumption can be achieve CVE-2021-384666.1InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 do not perform sufficient input validation on client requests from the h CVE-2021-384678.1A specific function code receives a raw pointer supplied by the user and deallocates this pointer. The user can then control what memory reg CVE-2021-384684.8InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 are vulnerable to stored cross-scripting, which may allow an attacker to CVE-2021-384697.1Many of the services used by the affected product do not specify full paths for the DLLs they are loading. An attacker can exploit the uncon CVE-2021-38477.8An unauthorized access to the execution of the setuid file with capabilities flaw in the Linux kernel OverlayFS subsystem was found in the w