CVE-2021-37471
A restricted shell escape sequence is possible on Cradlepoint IBR900-600 7.2.60 devices that can...
Cradlepoint IBR900-600 devices running versions < 7.21.10 are vulnerable to a restricted shell escape sequence that provides an attacker the capability to simultaneously deny availability to the device's NetCloud Manager console, local console and SSH command-line.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Cradlepoint IBR900-600 devices running versions < 7.21.10 are vulnerable to a restricted shell escape sequence that provides an attacker the capability to simultaneously deny availability to the device's NetCloud Manager console, local console and SSH command-line.
- Record
CVE-2021-37471- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 7.8 High
AV:N/AC:L/Au:N/C:N/I:N/A:C - Updated
- 2026-11-02
CVE List No score
Cradlepoint IBR900-600 devices running versions < 7.21.10 are vulnerable to a restricted shell escape sequence that provides an attacker the capability to simultaneously deny availability to the device's NetCloud Manager console, local console and SSH command-line.
- Record
CVE-2021-37471- Updated
- 2026-11-02
EUVDEUVD-2021-24036 No score
Cradlepoint IBR900-600 devices running versions < 7.21.10 are vulnerable to a restricted shell escape sequence that provides an attacker the capability to simultaneously deny availability to the device's NetCloud Manager console, local console and SSH command-line.
- Record
EUVD-2021-24036- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-4jx7-9647-hpx8
A restricted shell escape sequence is possible on Cradlepoint IBR900-600 7.2.60 devices that can...
A restricted shell escape sequence is possible on Cradlepoint IBR900-600 7.2.60 devices that can lead to an attacker denying the availability of all console or SSH command-line access.
- Record
GHSA-4jx7-9647-hpx8- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-37471 is a high vulnerability (CVSS 7.5) in Cradlepoint Ibr600 Firmware, published November 7, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.20%, the 68th percentile. No source names a fixed version.