CVE-2021-42324

HighCVSS 7.4/10Last modified Jun 17, 2026

Description

An issue was discovered on DCN (Digital China Networks) S4600-10P-SI devices before R0241.0470. Due to improper parameter validation in the console interface, it is possible for a low-privileged authenticated attacker to escape the sandbox environment and execute system commands as root via shell metacharacters in the capture command parameters. Command output will be shown on the Serial interface of the device. Exploitation requires both credentials and physical access.

Metrics

CVSS 3.1 7.4/10CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

VendorProductVersions
n/an/an/a

References

Timeline

Published
Apr 5, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-423259.8Froxlor through 0.10.29.1 allows SQL injection in Database/Manager/DbManagerMySQL.php via a custom DB name.CVE-2021-423265.3Redmine before 4.1.5 and 4.2.x before 4.2.3 may disclose the names of users on activity views due to an insufficient access filter.CVE-2021-423276.7dp_link_settings_write in drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c in the Linux kernel through 5.14.14 allows a heap-based CVE-2021-423295.4The “List_Add” function of message board of ShinHer StudyOnline System does not filter special characters in the title parameter. After loggCVE-2021-423308.8The “Teacher Edit” function of ShinHer StudyOnline System does not perform authority control. After logging in with user’s privilege, remoteCVE-2021-423315.4The “Study Edit” function of ShinHer StudyOnline System does not perform permission control. After logging in with user’s privilege, remote CVE-2021-423324.3The “List View” function of ShinHer StudyOnline System is not under authority control. After logging in with user’s privilege, remote attackCVE-2021-423338.8The Easytest contains SQL injection vulnerabilities. After obtaining user’s privilege, remote attackers can inject SQL commands into the parCVE-2021-423348.8The Easytest contains SQL injection vulnerabilities. After obtaining a user’s privilege, remote attackers can inject SQL commands into the pCVE-2021-423355.4Easytest bulletin board management function of online learning platform does not filter special characters. After obtaining a user’s privileCVE-2021-423364.3The learning history page of the Easytest is vulnerable by permission bypass. After obtaining a user’s permission, remote attackers can acceCVE-2021-423374.3The permission control of AIFU cashier management salary query function can be bypassed, thus after obtaining general user’s permission, the
CVE-2021-42324: High severity, CVSS 7.4 | Vulnix