CVE-2021-46422
Telesquare SDT-CW3B1 1.1.0 is affected by an OS command injection vulnerability that allows a...
Telesquare SDT-CW3B1 1.1.0 is affected by an OS command injection vulnerability that allows a remote attacker to execute OS commands without any authentication.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Telesquare SDT-CW3B1 1.1.0 is affected by an OS command injection vulnerability that allows a remote attacker to execute OS commands without any authentication.
- Record
CVE-2021-46422- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 10.0 High
AV:N/AC:L/Au:N/C:C/I:C/A:C - Weakness
- CWE-78
- Updated
- 2026-11-02
CVE List No score
Telesquare SDT-CW3B1 1.1.0 is affected by an OS command injection vulnerability that allows a remote attacker to execute OS commands without any authentication.
- Record
CVE-2021-46422- Updated
- 2026-11-02
EUVDEUVD-2021-33100 No score
Telesquare SDT-CW3B1 1.1.0 is affected by an OS command injection vulnerability that allows a remote attacker to execute OS commands without any authentication.
- Record
EUVD-2021-33100- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-8557-gh6f-6c42
Telesquare SDT-CW3B1 1.1.0 is affected by an OS command injection vulnerability that allows a...
Telesquare SDT-CW3B1 1.1.0 is affected by an OS command injection vulnerability that allows a remote attacker to execute OS commands without any authentication.
- Record
GHSA-8557-gh6f-6c42- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-78
- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | SDT-CW3B1 1.1.0 - OS Command Injection | 2022-05-17 |
| Exploit-DB | Telesquare SDT-CW3B1 1.1.0 - OS Command Injection | 2022-06-03 |
| Nuclei | SDT-CW3B1 1.1.0 - OS Command Injection | |
| PoC in GitHub | Awei507/CVE-RCE | 2022-10-15 |
| PoC in GitHub | CJ-0107/cve-2021-46422 | 2022-10-16 |
| PoC in GitHub | Chocapikk/CVE-2021-46422 | 2022-06-20 |
| PoC in GitHub | ZAxyr/CVE-2021-46422 | 2022-10-16 |
| PoC in GitHub | kailing0220/CVE-2021-46422 | 2022-10-16 |
| PoC in GitHub | kelemaoya/CVE-2021-46422 | 2022-10-16 |
| PoC in GitHub | latings/CVE-2021-46422 | 2022-10-16 |
Show 6 moreShow less
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | nobodyatall648/CVE-2021-46422 | 2022-05-24 |
| PoC in GitHub | polerstar/CVE-2021-46422-poc | 2022-10-16 |
| PoC in GitHub | twoning/CVE-2021-46422_PoC | 2022-07-14 |
| PoC in GitHub | xanszZZ/SDT_CW3B1_rce | 2022-10-16 |
| PoC in GitHub | yigexioabai/CVE-2021-46422_RCE | 2022-10-15 |
| PoC in GitHub | yyqxi/CVE-2021-46422 | 2022-10-16 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, Nuclei, NVD, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-46422 is a critical vulnerability (CVSS 9.8) in Telesquare Sdt-cs3b1 Firmware, published April 27, 2022. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 94.4%, the 99th percentile. No source names a fixed version.
References
drive.google.com/drive/folders/1YJlVlb4SlTEGONzIjiMwd2P7ucP_Pm7T?usp=sharing
packetstormsecurity.com/files/167201/SDT-CW3B1-1.1.0-Command-Injection.html
nvd.nist.gov/vuln/detail/CVE-2021-46422
github.com/advisories/GHSA-8557-gh6f-6c42