{"id":"CVE-2021-37913","aliases":["EUVD-2021-24391","GHSA-r586-r9hc-jwq2"],"status":"published","title":"HGiga OAKlouds - Command Injection-2","description":"The HGiga OAKlouds mobile portal does not filter special characters of the IPv6 Gateway parameter of the network interface card setting page. Remote attackers can use this vulnerability to perform command injection and execute arbitrary commands in the system without logging in.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.02832,"percentile":0.8682,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-78"],"published":"2021-09-15T19:10:25Z","modified":"2026-06-17T04:01:14Z","products":[{"vendor":"hgiga","product":"oaklouds oaksv2"},{"vendor":"hgiga","product":"oaklouds oaksv3"},{"vendor":"hgiga","product":"oaklouds_portal"}],"references":[{"url":"https://www.twcert.org.tw/tw/cp-132-5092-f88e2-1.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-37913"},{"url":"https://github.com/advisories/GHSA-r586-r9hc-jwq2"}],"sources":{"cve":[{"id":"CVE-2021-37913","title":"HGiga OAKlouds - Command Injection-2","description":"The HGiga OAKlouds mobile portal does not filter special characters of the IPv6 Gateway parameter of the network interface card setting page. Remote attackers can use this vulnerability to perform command injection and execute arbitrary commands in the system without logging in.","status":"published","published":"2021-09-15T19:10:25.84Z","modified":"2024-09-16T17:18:49.201Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:32:58.028461Z"}],"euvd":[{"id":"EUVD-2021-24391","description":"The HGiga OAKlouds mobile portal does not filter special characters of the IPv6 Gateway parameter of the network interface card setting page. Remote attackers can use this vulnerability to perform command injection and execute arbitrary commands in the system without logging in.","status":"published","published":"2021-09-15T19:10:25Z","modified":"2024-09-16T17:18:49Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T00:55:43.455642Z"}],"ghsa":[{"id":"GHSA-r586-r9hc-jwq2","title":"The HGiga OAKlouds mobile portal does not filter special characters of the IPv6 Gateway parameter...","description":"The HGiga OAKlouds mobile portal does not filter special characters of the IPv6 Gateway parameter of the network interface card setting page. Remote attackers can use this vulnerability to perform command injection and execute arbitrary commands in the system without logging in.","status":"published","published":"2022-05-24T19:14:33Z","modified":"2023-01-30T05:02:13Z","cwes":["CWE-78"],"updated_at":"2026-11-02T14:46:35.666418Z"}],"nvd":[{"id":"CVE-2021-37913","description":"The HGiga OAKlouds mobile portal does not filter special characters of the IPv6 Gateway parameter of the network interface card setting page. Remote attackers can use this vulnerability to perform command injection and execute arbitrary commands in the system without logging in.","status":"published","published":"2021-09-15T19:15:10Z","modified":"2026-06-17T04:01:14.393Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"2.0","score":10,"vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:06:58.502206Z"}]}}