CVE-2021-38469

HighCVSS 7.1/10Last modified Jun 17, 2026

Description

Many of the services used by the affected product do not specify full paths for the DLLs they are loading. An attacker can exploit the uncontrolled search path by implanting their own DLL near the affected product’s binaries, thus hijacking the loaded DLL.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-427

Affected software

Vendor	Product	Versions
AUVESY	Versiondog	>= All, <= 8.0

References

https://us-cert.cisa.gov/ics/advisories/icsa-21-292-01Patch, Third Party Advisory, US Government Resource
https://us-cert.cisa.gov/ics/advisories/icsa-21-292-01Patch, Third Party Advisory, US Government Resource

Timeline

Published: Oct 22, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-38477.8An unauthorized access to the execution of the setuid file with capabilities flaw in the Linux kernel OverlayFS subsystem was found in the w CVE-2021-384709.1InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 are vulnerable to an attacker using a ping tool to inject commands into CVE-2021-384719.1There are multiple API function codes that permit data writing to any file, which may allow an attacker to modify existing files or create n CVE-2021-384724.7InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 management portal does not contain an X-FRAME-OPTIONS header, which an a CVE-2021-384738.8The affected product’s code base doesn’t properly control arguments for specific functions, which could lead to a stack overflow.CVE-2021-384749.8InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 have has no account lockout policy configured for the login page of the CVE-2021-384758.8The database connection to the server is performed by calling a specific API, which could allow an unprivileged user to gain SYSDBA permissi CVE-2021-384765.3InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 authentication process response indicates and validates the existence of CVE-2021-384779.8There are multiple API function codes that permit reading and writing data to or from files and directories, which could lead to the manipul CVE-2021-384789.1InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 are vulnerable to an attacker using a traceroute tool to inject commands CVE-2021-384797.5Many API function codes receive raw pointers remotely from the user and trust these pointers as valid in-bound memory regions. An attacker c CVE-2021-38485.5An arbitrary file creation by privilege escalation vulnerability in Trend Micro Apex One, Apex One as a Service, Worry-Free Business Securit