UDP Technology/Geutebrück camera devices: Command injection in appfile.filename parameter leading to RCE

7.2 CVSS

Vulnerability Description

Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to command injection, which may allow an attacker to remotely execute arbitrary code.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-33554

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

Titouan Lazard and Ibrahim Ayadhi from RandoriSec reported these vulnerabilities.

References

More from Geutebrück

View All →

CVE-2021-33553

UDP Technology/Geutebrück camera devices: Command injection in command parameter leading to RCE

High 7.2

CVE-2021-33552

UDP Technology/Geutebrück camera devices: Command injection in date parameter leading to RCE

High 7.2

CVE-2021-33551

UDP Technology/Geutebrück camera devices: Command injection in environment.lang parameter leading to RCE

High 7.2

CVE-2021-33550

UDP Technology/Geutebrück camera devices: Command injection in date parameter leading to RCE

High 7.2

CVE-2021-33549

UDP Technology/Geutebrück camera devices: Buffer overflow in action parameter leading to RCE

High 7.2

Affected Vendor

Geutebrück

View all reports →

Affected Software

E2 Series, Encoder G-Code

Vulnerable Versions:

EBC-21xx 1.12.13.2, EBC-21xx 1.12.14.5, EFD-22xx 1.12.13.2, EFD-22xx 1.12.14.5, ETHC-22xx 1.12.13.2, ETHC-22xx 1.12.14.5, EWPC-22xx 1.12.13.2, EWPC-22xx 1.12.14.5, EBC-21xx, EFD-22xx, ETHC-22xx, EWPC-22xx, EEC-2xx 1.12.13.2, EEC-2xx 1.12.14.5, EEN-20xx 1.12.13.2, EEN-20xx 1.12.14.5, EEC-2xx, EEN-20xx