CVE-2021-33526

In MB connect line mbDIALUP versions <= 3.9R0.0 a low privileged local attacker can send a command to the service running with NT AUTHORITY\SYSTEM instructing it to execute a malicous OpenVPN configuration resulting in arbitrary code execution with the privileges of the service.

CVSS v3 7.8 HIGH
CVSS v2.0 7.2 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.2^/10

CVSS v2.0 : HIGH

Vector : AV:L/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 3.9 / Impact : 10.0

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
https://cert.vde.com/de-de/advisories/vde-2021-017	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:mbconnectline:mbdialup:*:*:*:*:*:*:*:*

History

10 Aug 2021, 17:36

Type	Values Removed	Values Added
References	~~(CONFIRM) https://cert.vde.com/de-de/advisories/vde-2021-017 -~~	(CONFIRM) https://cert.vde.com/de-de/advisories/vde-2021-017 - Third Party Advisory
CWE		CWE-269
CPE		cpe:2.3:a:mbconnectline:mbdialup::::::::
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : 7.2 v3 : 7.8

02 Aug 2021, 11:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2021-08-02 11:15

Updated : 2023-12-10 13:55

NVD link : CVE-2021-33526

Mitre link : CVE-2021-33526

CVE.ORG link : CVE-2021-33526

JSON object : View

Products Affected

mbconnectline

mbdialup

CWE

CWE-269

Improper Privilege Management

{"id": "CVE-2021-33526", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.2, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}, {"type": "Secondary", "source": "info@cert.vde.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "published": "2021-08-02T11:15:11.223", "references": [{"url": "https://cert.vde.com/de-de/advisories/vde-2021-017", "tags": ["Third Party Advisory"], "source": "info@cert.vde.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-269"}]}, {"type": "Secondary", "source": "info@cert.vde.com", "description": [{"lang": "en", "value": "CWE-269"}]}], "descriptions": [{"lang": "en", "value": "In MB connect line mbDIALUP versions <= 3.9R0.0 a low privileged local attacker can send a command to the service running with NT AUTHORITY\\SYSTEM instructing it to execute a malicous OpenVPN configuration resulting in arbitrary code execution with the privileges of the service."}, {"lang": "es", "value": "En MB connect line mbDIALUP versiones anteriores a 3.9R0.0 incluy\u00e9ndola, un atacante local con pocos privilegios puede enviar un comando al servicio que se ejecuta con NT AUTHORITY\\SYSTEM indic\u00e1ndole que ejecute una configuraci\u00f3n OpenVPN maliciosa resultando en una ejecuci\u00f3n de c\u00f3digo arbitrario con los privilegios del servicio"}], "lastModified": "2021-08-10T17:36:30.123", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mbconnectline:mbdialup:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C0769704-3781-41C1-B70E-AE4B53CDFCA6", "versionEndIncluding": "3.9r0.0"}], "operator": "OR"}]}], "sourceIdentifier": "info@cert.vde.com"}