CVE-2021-38703

moderate-risk
Published 2021-09-01

Wireless devices running certain Arcadyan-derived firmware (such as KPN Experia WiFi 1.00.15) do not properly sanitise user input to the syslog configuration form. An authenticated remote attacker could leverage this to alter the device configuration and achieve remote code execution. This can be exploited in conjunction with CVE-2021-20090.

Do I need to act?

~
6.4% chance of exploitation in next 30 days
EPSS score — moderate exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
8
CVSS 8.8/10 High
NETWORK / LOW complexity

Affected Products (1)

Experia Wifi Firmware

Affected Vendors

Kpn

References (4)

Exploit https://7bits.nl/journal/posts/cve-2021-38703-kpn-experia-wifi-root-shell/
Vendor Advisory https://www.kpnwebshop.com/modems-routers/producten/experia-wifi/2
Exploit https://7bits.nl/journal/posts/cve-2021-38703-kpn-experia-wifi-root-shell/
Vendor Advisory https://www.kpnwebshop.com/modems-routers/producten/experia-wifi/2
44
/ 100
moderate-risk
Severity 30/34 · Critical
Exploitability 9/34 · Low
Exposure 5/34 · Minimal