CVE-2021-46354

EPSS 12.8%

Vexday Risk Score

28Low

SSVC decision (CISA)

Attend

PoC available → attend closely

Exploit maturity

Proof of concept

Public proof of concept exists, but not yet automated.

CVSS —EPSS 12.8%KEV nãoPoC públicaNuclei —Metasploit —Patch —

Lifecycle

09 Feb 2022Published on NVD

21 Feb 2022Public PoC

Weaponization speed

11 daysto first PoC

Recommendation: Plan a near-term fix — a public PoC already exists.

Thinfinity VirtualUI 2.1.28.0, 2.1.32.1 and 2.5.26.2, fixed in version 3.0 is affected by an information disclosure vulnerability in the parameter "Addr" in cmd site. The ability to send requests to other systems can allow the vulnerable server to filtrate the real IP of the web server or increase the attack surface.

Affected products

n/a · n/a

public PoCs found — 2

cve_referencepacketstormsecurity.com/files/166069/Thinfinity-VirtualUI-2.5.26.2-Information-Disclosure.htmlunverified exploitdbwww.exploit-db.com/exploits/50771unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://packetstormsecurity.com/files/166069/Thinfinity-VirtualUI-2.5.26.2-Information-Disclosure.html https://github.com/cybelesoft/virtualui/issues/3