CVE-2021-38477

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

There are multiple API function codes that permit reading and writing data to or from files and directories, which could lead to the manipulation and/or the deletion of files.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-73

Affected software

No affected versions have been published.

Timeline

Published
Oct 22, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-384789.1InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 are vulnerable to an attacker using a traceroute tool to inject commandsCVE-2021-384797.5Many API function codes receive raw pointers remotely from the user and trust these pointers as valid in-bound memory regions. An attacker cCVE-2021-38485.5An arbitrary file creation by privilege escalation vulnerability in Trend Micro Apex One, Apex One as a Service, Worry-Free Business SecuritCVE-2021-384808.8InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 are vulnerable to cross-site request forgery when unauthorized commands CVE-2021-384819.8The scheduler service running on a specific TCP port enables the user to start and stop jobs. There is no sanitation of the supplied JOB ID CVE-2021-384824.8InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 website used to control the router is vulnerable to stored cross-site scCVE-2021-384835.7The affected product is vulnerable to misconfigured binaries, allowing users on the target PC with SYSTEM level privileges access to overwriCVE-2021-384847.2InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 do not have a filter or signature check to detect or prevent an upload oCVE-2021-384858.8The affected product is vulnerable to improper input validation in the restore file. This enables an attacker to provide malicious config fiCVE-2021-384868.5InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 cloud portal allows for self-registration of the affected product withouCVE-2021-384879.1RTI Connext Professional versions 4.1 to 6.1.0, and Connext Micro versions 2.4 and later are vulnerable when an attacker sends a specially cCVE-2021-384884.8Delta Electronics DIALink versions 1.2.4.0 and prior is vulnerable to cross-site scripting because an authenticated attacker can inject arbi
CVE-2021-38477: Critical severity, CVSS 9.8 | Vulnix