CVE-2021-38467

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

A specific function code receives a raw pointer supplied by the user and deallocates this pointer. The user can then control what memory regions will be freed and cause use-after-free condition.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-416

Affected software

No affected versions have been published.

Timeline

Published: Oct 22, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-384684.8InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 are vulnerable to stored cross-scripting, which may allow an attacker to CVE-2021-384697.1Many of the services used by the affected product do not specify full paths for the DLLs they are loading. An attacker can exploit the uncon CVE-2021-38477.8An unauthorized access to the execution of the setuid file with capabilities flaw in the Linux kernel OverlayFS subsystem was found in the w CVE-2021-384709.1InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 are vulnerable to an attacker using a ping tool to inject commands into CVE-2021-384719.1There are multiple API function codes that permit data writing to any file, which may allow an attacker to modify existing files or create n CVE-2021-384724.7InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 management portal does not contain an X-FRAME-OPTIONS header, which an a CVE-2021-384738.8The affected product’s code base doesn’t properly control arguments for specific functions, which could lead to a stack overflow.CVE-2021-384749.8InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 have has no account lockout policy configured for the login page of the CVE-2021-384758.8The database connection to the server is performed by calling a specific API, which could allow an unprivileged user to gain SYSDBA permissi CVE-2021-384765.3InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 authentication process response indicates and validates the existence of CVE-2021-384779.8There are multiple API function codes that permit reading and writing data to or from files and directories, which could lead to the manipul CVE-2021-384789.1InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 are vulnerable to an attacker using a traceroute tool to inject commands