CVE-2021-42071

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

In Visual Tools DVR VX16 4.2.28.0, an unauthenticated attacker can achieve remote command execution via shell metacharacters in the cgi-bin/slogin/login.py User-Agent HTTP header.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://visual-tools.com/Vendor Advisory
https://www.exploit-db.com/exploits/50098Exploit, Third Party Advisory, VDB Entry
https://www.swascan.com/security-advisory-visual-tools-dvr-cve-2021-42071/Exploit, Third Party Advisory
https://visual-tools.com/Vendor Advisory
https://www.exploit-db.com/exploits/50098Exploit, Third Party Advisory, VDB Entry
https://www.swascan.com/security-advisory-visual-tools-dvr-cve-2021-42071/Exploit, Third Party Advisory

Timeline

Published: Oct 7, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-420728.8An issue was discovered in Barrier before 2.4.0. The barriers component (aka the server-side implementation of Barrier) does not sufficientl CVE-2021-420738.2An issue was discovered in Barrier before 2.4.0. An attacker can enter an active session state with the barriers component (aka the server-s CVE-2021-420747.5An issue was discovered in Barrier before 2.3.4. An unauthenticated attacker can cause a segmentation fault in the barriers component (aka t CVE-2021-420757.5An issue was discovered in Barrier before 2.3.4. The barriers component (aka the server-side implementation of Barrier) does not correctly c CVE-2021-420767.5An issue was discovered in Barrier before 2.3.4. An attacker can cause memory exhaustion in the barriers component (aka the server-side impl CVE-2021-420779.8PHP Event Calendar before 2021-09-03 allows SQL injection, as demonstrated by the /server/ajax/user_manager.php username parameter. This can CVE-2021-420786.1PHP Event Calendar through 2021-11-04 allows persistent cross-site scripting (XSS), as demonstrated by the /server/ajax/events_manager.php t CVE-2021-420794.9An authenticated administrator is able to prepare an alert that is able to execute an SSRF attack. This is exclusively with POST requests. CVE-2021-42087.2The ExportFeed WordPress plugin through 2.0.1.0 does not sanitise and escape the product_id POST parameter before using it in a SQL statemen CVE-2021-420807.4An attacker is able to launch a Reflected XSS attack using a crafted URL. POC: Visit the following URL https://<IPADDRESS>:8153/qstorapi/e CVE-2021-420817.2An authenticated administrator is allowed to remotely execute arbitrary shell commands via the API. POC http://<IP_ADDRESS>/qstorapi/storag CVE-2021-420827.8Local users are able to execute scripts under root privileges. POC On the local host run the following command: curl 'localhost:8154/qsto