CVE-2021-38461

HighCVSS 8.2/10Last modified Jun 17, 2026

Description

The affected product uses a hard-coded blowfish key for encryption/decryption processes. The key can be easily extracted from binaries.

Metrics

CVSS 3.1 8.2/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N

Weakness enumeration

CWE-321CWE-798

Affected software

No affected versions have been published.

Timeline

Published
Oct 22, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-384629.8InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 does not enforce an efficient password policy. This may allow an attackeCVE-2021-384638.1The affected product does not properly control the allocation of resources. A user may be able to allocate unlimited memory buffers using APCVE-2021-384647.4InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 have inadequate encryption strength, which may allow an attacker to inteCVE-2021-384656.5The webinstaller is a Golang web server executable that enables the generation of an Auvesy image agent. Resource consumption can be achieveCVE-2021-384666.1InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 do not perform sufficient input validation on client requests from the hCVE-2021-384678.1A specific function code receives a raw pointer supplied by the user and deallocates this pointer. The user can then control what memory regCVE-2021-384684.8InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 are vulnerable to stored cross-scripting, which may allow an attacker toCVE-2021-384697.1Many of the services used by the affected product do not specify full paths for the DLLs they are loading. An attacker can exploit the unconCVE-2021-38477.8An unauthorized access to the execution of the setuid file with capabilities flaw in the Linux kernel OverlayFS subsystem was found in the wCVE-2021-384709.1InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 are vulnerable to an attacker using a ping tool to inject commands into CVE-2021-384719.1There are multiple API function codes that permit data writing to any file, which may allow an attacker to modify existing files or create nCVE-2021-384724.7InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 management portal does not contain an X-FRAME-OPTIONS header, which an a
CVE-2021-38461: High severity, CVSS 8.2 | Vulnix