CVE-2021-38759

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Raspberry Pi OS through 5.10 has the raspberry default password for the pi account. If not changed, attackers can gain administrator privileges.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-1188

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/165211/Raspberry-Pi-5.10-Default-Credentials.htmlThird Party Advisory, VDB Entry
https://arstechnica.com/gadgets/2022/04/raspberry-pi-os-axes-longstanding-default-user-account-in-the-name-of-security/Third Party Advisory
https://www.cnvd.org.cn/flaw/show/CNVD-2021-43968Third Party Advisory
https://www.raspberrypi.com/documentation/computers/configuration.html#change-the-default-passwordVendor Advisory
http://packetstormsecurity.com/files/165211/Raspberry-Pi-5.10-Default-Credentials.htmlThird Party Advisory, VDB Entry
https://arstechnica.com/gadgets/2022/04/raspberry-pi-os-axes-longstanding-default-user-account-in-the-name-of-security/Third Party Advisory
https://www.cnvd.org.cn/flaw/show/CNVD-2021-43968Third Party Advisory
https://www.raspberrypi.com/documentation/computers/configuration.html#change-the-default-passwordVendor Advisory

Timeline

Published: Dec 7, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-387727.5Tenda AC10-1200 v15.03.06.23_EN was discovered to contain a buffer overflow via the list parameter in the fromSetIpMacBind function.CVE-2021-38789.8corenlp is vulnerable to Improper Restriction of XML External Entity Reference CVE-2021-387837.5There is a Out-of-Bound Write in the Allwinner R818 SoC Android Q SDK V1.0 camera driver "/dev/cedar_dev" through iotcl cmd IOCTL_SET_PROC_I CVE-2021-387847.5There is a NULL pointer dereference in the syscall open_exec function of Allwinner R818 SoC Android Q SDK V1.0 that could executable a malic CVE-2021-387857.5There is a NULL pointer deference in the Allwinner R818 SoC Android Q SDK V1.0 camera driver /dev/cedar_dev that could use the ioctl cmd IOC CVE-2021-387867.5There is a NULL pointer dereference in media/libcedarc/vdecoder of Allwinner R818 SoC Android Q SDK V1.0, which could cause a media crash (d CVE-2021-387877.5There is an integer overflow in the ION driver "/dev/ion" of Allwinner R818 SoC Android Q SDK V1.0 that could use the ioctl cmd "COMPAT_ION_CVE-2021-387887.5The Background service in Allwinner R818 SoC Android Q SDK V1.0 is used to manage background applications. Malicious apps can use the interf CVE-2021-387897.5Allwinner R818 SoC Android Q SDK V1.0 is affected by an incorrect access control vulnerability that does not check the caller's permission, CVE-2021-38795.4snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2021-38819.8libmobi is vulnerable to Out-of-bounds Read CVE-2021-388198.8A SQL injection vulnerability exits on the Simple Image Gallery System 1.0 application through "id" parameter on the album page.