CVE-2021-36707 is a critical command injection vulnerability affecting ProLink PRC2402M V1.0.18 and older firmware. The flaw exists in the set_ledonoff function within the adm.cgi binary, where the led_cmd parameter is directly passed to do_system without proper sanitization. This allows an unauthenticated attacker to execute arbitrary commands on the device. With a CVSS score of 9.8, this vulnerability is considered critical due to its network-based attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability. The FAUCET Risk Score of 90/100 further emphasizes its severity. Despite its critical nature, there is no evidence of active exploitation, and no public exploit code is available on platforms like Metasploit or ExploitDB. The vulnerability has also garnered minimal community discussion or media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 1.0.18CPE matchmatch criteria | cpe:2.3:o:prolink:prc2402m_firmware:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.