CVE-2021-25162

highPriorität · beachten · 51EPSS 0.258 · 98. PerzentilExploit · PoCDEEURUUS

grimoire priorityP1 · Urgent

Exploitable?

Public exploit

2 exploits · PoC

Likely / severe?

25.8% (98th) EPSS

CVSS 9.3 · high

Is it mine?

25 products

Prüfe deine Angriffsfläche

Who says so?

6 sources

cnnvd · enisa_euvd · fstec_bdu · cisa_csaf_ot

EPSS · bewertet 2026-10-26

A remote execution of arbitrary commands vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 6.4.x: 6.4.4.8-4.2.4.17 and below; Aruba Instant 6.5.x: 6.5.4.18 and below; Aruba Instant 8.3.x: 8.3.0.14 and below; Aruba Instant 8.5.x: 8.5.0.11 and below; Aruba Instant 8.6.x: 8.6.0.7 and below; Aruba Instant 8.7.x: 8.7.1.1 and below. Aruba has released patches for Aruba Instant that address this security vulnerability.

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Ein Hersteller-Fix ist verfügbar.

BehobenSCALANCE W1750Dsiemens_psirt
Update to V8.7.1.3 or later version
https://support.industry.siemens.com/cs/de/en/view/109802805/
BehobenSCALANCE W1750Dcisa_csaf_ot
Update to V8.7.1.3 or later version
https://support.industry.siemens.com/cs/de/en/view/109802805/
MitigationSCALANCE W1750Dsiemens_psirt
Block access to the Aruba Instant Command Line Interface from all untrusted users
MitigationSCALANCE W1750Dcisa_csaf_ot
Block access to the Aruba Instant Command Line Interface from all untrusted users

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

9.3

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen

v2.09.3highAV:N/AC:M/Au:N/C:C/I:C/A:Cprimary · NVD / NIST USAusnutzbarkeit 8.6 · Auswirkung 10

v3.18.1highCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USAusnutzbarkeit 2.2 · Auswirkung 5.9

v3.18.1highCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:Csecondary · CISA US

v3.18.1highAV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v3.18.1highCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:Csecondary · Siemens ProductCERT DE

v3.17.7highCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:Psecondary · CVSS-BT (t0sche)

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-78USprimärCWE-77USCWE-77USCWE-78US

Exploits (2)

Öffentlicher Proof-of-Concept- und Exploit-Code.

EDB-50136Aruba Instant (IAP) - Remote Code ExecutionPoC · exploit_db
maguireja/CVE-2021-25162CVE-2021-25162PoC · poc_in_github

betroffene Produkte (25)

Betroffene Produkte und Versionsbereiche.

SCALANCE W1750Dalle Versionencisa_csaf_otUS
Siemens SCALANCE W1750D< V8.7.0cisa_csaf_otUS
Siemens SCALANCE W1750DV8.7.0_and_ → V8.7.1.3cisa_csaf_otUS
n/a Aruba Instant Access Points≤ Aruba Instant 8.3.x: 8.3.0.14 and belowenisa_euvdEU
n/a Aruba Instant Access Points≤ Aruba Instant 6.5.x: 6.5.4.18 and belowenisa_euvdEU
n/a Aruba Instant Access Points≤ Aruba Instant 6.4.x: 6.4.4.8-4.2.4.17 and belowenisa_euvdEU
n/a Aruba Instant Access Points≤ Aruba Instant 8.7.x: 8.7.1.1 and belowenisa_euvdEU
n/a Aruba Instant Access Points≤ Aruba Instant 8.5.x: 8.5.0.11 and belowenisa_euvdEU
n/a Aruba Instant Access Points≤ Aruba Instant 8.6.x: 8.6.0.7 and belowenisa_euvdEU
Aruba Networks Aruba Instant6.4.0.0 → 6.4.4.8-4.2.4.18fstec_bduRU
Aruba Networks Aruba Instant6.5.0.0 → 6.5.4.19fstec_bduRU
Aruba Networks Aruba Instant8.3.0.0 → 8.3.0.15fstec_bduRU
Aruba Networks Aruba Instant8.5.0.0 → 8.5.0.12fstec_bduRU
Aruba Networks Aruba Instant8.6.0.0 → 8.6.0.8fstec_bduRU
Aruba Networks Aruba Instant8.7.0.0 → 8.7.1.2fstec_bduRU
Siemens AG SCALANCE W1750D8.7.0 → 8.7.1.3fstec_bduRU
arubanetworks instant6.4.0.0 → 6.4.4.8-4.2.4.18nvdUScpe:2.3:o:arubanetworks:instant:*:*:*:*:*:*:*:*
arubanetworks instant6.5.0.0 → 6.5.4.19nvdUScpe:2.3:o:arubanetworks:instant:*:*:*:*:*:*:*:*
arubanetworks instant8.3.0.0 → 8.3.0.15nvdUScpe:2.3:o:arubanetworks:instant:*:*:*:*:*:*:*:*
arubanetworks instant8.5.0.0 → 8.5.0.12nvdUScpe:2.3:o:arubanetworks:instant:*:*:*:*:*:*:*:*

20 von 25 angezeigt

Advisories (2)

Hersteller- und Ökosystem-Meldungen dazu.

SSA-723417SSA-723417: Multiple Vulnerabilities in SCALANCE W1750D2021-05-11csaf · siemens_psirtDE
The Scalance W1750D device contains multiple vulnerabilities that could allow an attacker to inject commands or trigger buffer overflows. Siemens has released updates for the affected products and recommends to update to the latest versions.
ICSA-21-131-14Siemens SCALANCE W1750D (Update B)2021-05-11icsa · cisa_csaf_otUS
The Scalance W1750D device contains multiple vulnerabilities that could allow an attacker to inject commands or trigger buffer overflows. Siemens has released updates for the affected products and recommends to update to the latest versions.

auch bekannt als (6)

Weitere Namen und Kennungen dieser Entität.

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvd enisa_euvd fstec_bdu cisa_csaf_ot nvd siemens_psirt NVD CVE.org MITRE

veröffentlicht 2021-03-30geändert 2026-06-17

verwandt (7,926)

Verwandte Einträge.

ID	Schweregrad	EPSS	ausnutzbar	veröffentlicht
CVE-2026-106931US	—OT kritisch	2.53% (85th)	KEV	2026-10-14
SiteGuard Server Edition contains an OS command injection vulnerability, which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system r…
CVE-2026-110447US	critical9.8OT kritisch	12.3% (96th)	KEV	2026-10-14
Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a…
CVE-2026-105134US	critical10.0OT kritisch	86.3% (100th)	KEV	2026-10-04
A flaw has been found in Ahsay AhsayCBS up to 9.15.2.69/10.3.4.44. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do of the component Replication…
CVE-2026-83549US	—OT kritisch	9.89% (96th)	KEV	2026-09-01
Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identified in the SMA1000 Appliance Management…
CVE-2026-74233US	critical9.8OT kritisch	3.37% (89th)	—	2026-08-27
Zbtlink WE1326, WE357, WE5926, WE5926-WD, WE826-Q, WE826-T2, WE826-WD, WG108, and WG3526 firmware 19.1101, Zbtlink WE2426-C firmware 19.1112, Zbtlink WE5926-EC_QP firmware 20.0516,…

+7921 weitere

Referenzen (13)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan