CVE-2021-20140 is an unauthenticated command injection vulnerability affecting Gryphon Tower routers. An attacker on the same network can execute arbitrary commands as root by sending a specially crafted packet to the controller_server service. This vulnerability has a high CVSS score of 8.8 due to its network-adjacent attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability. There is currently no public exploit code available (Metasploit, Nuclei, ExploitDB), and it has not been added to CISA's KEV catalog. Community discussion and media coverage for this CVE are minimal.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 04.0004.12CPE matchmatch criteria | cpe:2.3:o:gryphonconnect:gryphon_tower_firmware:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.2 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.