CVE-2021-33527: OS Command Injection in mbDIALUP <= 3.9R0.0

Severity: critical (CVSS 10.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-08-02 · updated 2026-06-17
Weakness: CWE-20

Description

In MB connect line mbDIALUP versions <= 3.9R0.0 a remote attacker can send a specifically crafted HTTP request to the service running with NT AUTHORITY\SYSTEM that will not correctly validate the input. This can lead to an arbitrary code execution with the privileges of the service.

Affected products

MB connect line mbDIALUP: through 3.9r0.0

References

https://cert.vde.com/de-de/advisories/vde-2021-017
https://cert.vde.com/de-de/advisories/vde-2021-017

Get alerted when CVE-2021-33527 or the next vulnerability affects your stack