CVE-2021-46704

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

In GenieACS 1.2.x before 1.2.8, the UI interface API is vulnerable to unauthenticated OS command injection via the ping host argument (lib/ui/api.ts and lib/ping.ts). The vulnerability arises from insufficient input validation combined with a missing authorization check.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/genieacs/genieacs/commit/7f295beeecc1c1f14308a93c82413bb334045af6Patch, Third Party Advisory
https://github.com/genieacs/genieacs/releases/tag/v1.2.8Release Notes, Third Party Advisory
https://github.com/genieacs/genieacs/commit/7f295beeecc1c1f14308a93c82413bb334045af6Patch, Third Party Advisory
https://github.com/genieacs/genieacs/releases/tag/v1.2.8Release Notes, Third Party Advisory

Timeline

Published: Mar 6, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-467054.4A Insecure Temporary File vulnerability in grub-once of grub2 in SUSE Linux Enterprise Server 15 SP4, openSUSE Factory allows local attacker CVE-2021-467086.1The swagger-ui-dist package before 4.1.3 for Node.js could allow a remote attacker to hijack the clicking action of the victim. By persuadin CVE-2021-467096.1phpLiteAdmin through 1.9.8.2 allows XSS via the index.php newRows parameter (aka num or number).CVE-2021-467407.5The device authentication service module has a defect vulnerability introduced in the design process.Successful exploitation of this vulnera CVE-2021-467417.5The basic framework and setting module have defects, which were introduced during the design. Successful exploitation of this vulnerability CVE-2021-467429.1The multi-window module has a vulnerability of unauthorized insertion and tampering of Settings.Secure data.Successful exploitation of this CVE-2021-467439.1In Firebase PHP-JWT before 6.0.0, an algorithm-confusion issue (e.g., RS256 / HS256) exists via the kid (aka Key ID) header, when multiple t CVE-2021-467446.5An attacker with access to a malicious hypervisor may be able to infer data values used in a SEV guest on AMD CPUs by monitoring ciphertext CVE-2021-467465.2Lack of stack protection exploit mechanisms in ASP Secure OS Trusted Execution Environment (TEE) may allow a privileged attacker with access CVE-2021-467477.1Insufficient granularity of access control in ASP (AMD Secure Processor) may allow an attacker with an untrusted user space application to m CVE-2021-467485.5Insufficient bounds checking in the ASP (AMD Secure Processor) may allow an attacker to access memory outside the bounds of what is permissi CVE-2021-467497.5Insufficient bounds checking in ASP (AMD Secure Processor) may allow for an out of bounds read in SMI (System Management Interface) mailbox