CVE-2021-20676

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-03-18 · updated 2026-06-17
Weakness: CWE-863

Description

M-System DL8 series (type A (DL8-A) versions prior to Ver3.0, type B (DL8-B) versions prior to Ver3.0, type C (DL8-C) versions prior to Ver3.0, type D (DL8-D) versions prior to Ver3.0, and type E (DL8-E) versions prior to Ver3.0) allows remote authenticated attackers to bypass access restriction and conduct prohibited operations via unspecified vectors.

Affected products

M-System Dl8-A Firmware: before 3.0.81 — fixed in 3.0.81
M-System Dl8-B Firmware: before 3.0.77 — fixed in 3.0.77
M-System Dl8-C Firmware: before 3.0.99 — fixed in 3.0.99
M-System Dl8-D Firmware: before 3.0.91 — fixed in 3.0.91
M-System Dl8-E Firmware: before 3.0.12 — fixed in 3.0.12

How to fix

Upgrade to a fixed version: M-System Dl8-A Firmware 3.0.81; M-System Dl8-B Firmware 3.0.77; M-System Dl8-C Firmware 3.0.99; M-System Dl8-D Firmware 3.0.91; M-System Dl8-E Firmware 3.0.12. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-20676 or the next vulnerability affects your stack