CVE-2021-33965

China Mobile An Lianbao WF-1 V1.0.1 router provides a web interface /api/ZRMesh/set_ZRMesh which...

8.8 High

China Mobile An Lianbao WF-1 V1.0.1 router provides a web interface /api/ZRMesh/set_ZRMesh which receives parameters by POST request, and the parameter mesh_enable and mesh_device have a command injection vulnerability. An attacker can use the vulnerability to execute remote commands.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

2.87%Up 1.8 points since Jan 19, 2022

What each source reports

NVD Score used 8.8

Record: CVE-2021-33965
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0: 6.5 MediumAV:N/AC:L/Au:S/C:P/I:P/A:P
Weakness: CWE-77
Updated: 2026-11-02

CVE List No score

Record: CVE-2021-33965
Updated: 2026-11-02

EUVDEUVD-2021-20636 No score

Record: EUVD-2021-20636
Updated: 2026-11-03

GitHub AdvisoriesGHSA-ch37-wgm7-x46g No score

China Mobile An Lianbao WF-1 V1.0.1 router provides a web interface /api/ZRMesh/set_ZRMesh which...

Record: GHSA-ch37-wgm7-x46g
Weakness: CWE-77
Updated: 2026-11-02

Affected products

chinamobile an lianbao wf-1 firmware

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-33965 is a high vulnerability (CVSS 8.8) in Chinamobile An Lianbao Wf-1 Firmware, published January 18, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.87%, the 86th percentile. No source names a fixed version.