{"id":"CVE-2021-46422","aliases":["EUVD-2021-33100","GHSA-8557-gh6f-6c42"],"status":"published","title":"Telesquare SDT-CW3B1 1.1.0 is affected by an OS command injection vulnerability that allows a...","description":"Telesquare SDT-CW3B1 1.1.0 is affected by an OS command injection vulnerability that allows a remote attacker to execute OS commands without any authentication.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.94425,"percentile":0.99852,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-78"],"published":"2022-04-27T11:04:00Z","modified":"2026-06-17T04:14:52Z","exploits":[{"source":"exploitdb","id":"EDB-50936","title":"SDT-CW3B1 1.1.0 - OS Command Injection","type":"remote","platform":"hardware","date":"2022-05-17","url":"https://www.exploit-db.com/exploits/50936"},{"source":"exploitdb","id":"EDB-50948","title":"Telesquare SDT-CW3B1 1.1.0 - OS Command Injection","type":"remote","platform":"hardware","date":"2022-06-03","url":"https://www.exploit-db.com/exploits/50948"},{"source":"nuclei","id":"CVE-2021-46422","title":"SDT-CW3B1 1.1.0 - OS Command Injection","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-46422.yaml"},{"source":"pocgithub","id":"Awei507/CVE-RCE","title":"Awei507/CVE-RCE","date":"2022-10-15","url":"https://github.com/Awei507/CVE-RCE"},{"source":"pocgithub","id":"CJ-0107/cve-2021-46422","title":"CJ-0107/cve-2021-46422","date":"2022-10-16","url":"https://github.com/CJ-0107/cve-2021-46422"},{"source":"pocgithub","id":"Chocapikk/CVE-2021-46422","title":"Chocapikk/CVE-2021-46422","date":"2022-06-20","url":"https://github.com/Chocapikk/CVE-2021-46422"},{"source":"pocgithub","id":"ZAxyr/CVE-2021-46422","title":"ZAxyr/CVE-2021-46422","date":"2022-10-16","url":"https://github.com/ZAxyr/CVE-2021-46422"},{"source":"pocgithub","id":"kailing0220/CVE-2021-46422","title":"kailing0220/CVE-2021-46422","date":"2022-10-16","url":"https://github.com/kailing0220/CVE-2021-46422"},{"source":"pocgithub","id":"kelemaoya/CVE-2021-46422","title":"kelemaoya/CVE-2021-46422","date":"2022-10-16","url":"https://github.com/kelemaoya/CVE-2021-46422"},{"source":"pocgithub","id":"latings/CVE-2021-46422","title":"latings/CVE-2021-46422","date":"2022-10-16","url":"https://github.com/latings/CVE-2021-46422"},{"source":"pocgithub","id":"nobodyatall648/CVE-2021-46422","title":"nobodyatall648/CVE-2021-46422","date":"2022-05-24","url":"https://github.com/nobodyatall648/CVE-2021-46422"},{"source":"pocgithub","id":"polerstar/CVE-2021-46422-poc","title":"polerstar/CVE-2021-46422-poc","date":"2022-10-16","url":"https://github.com/polerstar/CVE-2021-46422-poc"},{"source":"pocgithub","id":"twoning/CVE-2021-46422_PoC","title":"twoning/CVE-2021-46422_PoC","date":"2022-07-14","url":"https://github.com/twoning/CVE-2021-46422_PoC"},{"source":"pocgithub","id":"xanszZZ/SDT_CW3B1_rce","title":"xanszZZ/SDT_CW3B1_rce","date":"2022-10-16","url":"https://github.com/xanszZZ/SDT_CW3B1_rce"},{"source":"pocgithub","id":"yigexioabai/CVE-2021-46422_RCE","title":"yigexioabai/CVE-2021-46422_RCE","date":"2022-10-15","url":"https://github.com/yigexioabai/CVE-2021-46422_RCE"},{"source":"pocgithub","id":"yyqxi/CVE-2021-46422","title":"yyqxi/CVE-2021-46422","date":"2022-10-16","url":"https://github.com/yyqxi/CVE-2021-46422"}],"products":[{"vendor":"telesquare","product":"sdt-cs3b1_firmware"}],"references":[{"url":"https://drive.google.com/drive/folders/1YJlVlb4SlTEGONzIjiMwd2P7ucP_Pm7T?usp=sharing","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory"]},{"url":"http://packetstormsecurity.com/files/167201/SDT-CW3B1-1.1.0-Command-Injection.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory"]},{"url":"http://packetstormsecurity.com/files/167387/Telesquare-SDT-CW3B1-1.1.0-Command-Injection.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-46422"},{"url":"https://github.com/advisories/GHSA-8557-gh6f-6c42"}],"sources":{"cve":[{"id":"CVE-2021-46422","description":"Telesquare SDT-CW3B1 1.1.0 is affected by an OS command injection vulnerability that allows a remote attacker to execute OS commands without any authentication.","status":"published","published":"2022-04-27T11:04:00Z","modified":"2024-08-04T05:02:11.532Z","updated_at":"2026-11-02T14:33:02.930115Z"}],"euvd":[{"id":"EUVD-2021-33100","description":"Telesquare SDT-CW3B1 1.1.0 is affected by an OS command injection vulnerability that allows a remote attacker to execute OS commands without any authentication.","status":"published","published":"2022-04-27T11:04:00Z","modified":"2024-08-04T05:02:11Z","updated_at":"2026-11-03T03:08:24.142295Z"}],"ghsa":[{"id":"GHSA-8557-gh6f-6c42","title":"Telesquare SDT-CW3B1 1.1.0 is affected by an OS command injection vulnerability that allows a...","description":"Telesquare SDT-CW3B1 1.1.0 is affected by an OS command injection vulnerability that allows a remote attacker to execute OS commands without any authentication.","status":"published","published":"2022-04-28T00:00:34Z","modified":"2023-01-30T05:00:28Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:46:13.0899Z"}],"nvd":[{"id":"CVE-2021-46422","description":"Telesquare SDT-CW3B1 1.1.0 is affected by an OS command injection vulnerability that allows a remote attacker to execute OS commands without any authentication.","status":"published","published":"2022-04-27T13:15:09.173Z","modified":"2026-06-17T04:14:52.05Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":10,"vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:07:06.029737Z"}]}}