What’s Vulnerable › Vulnerabilities

CVE-2021-33887

• Severity: medium (CVSS 6.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-06-15 · updated 2026-06-17
• Weakness: CWE-345

Description

Insufficient verification of data authenticity in Peloton TTR01 up to and including PTV55G allows an attacker with physical access to boot into a modified kernel/ramdisk without unlocking the bootloader.

Affected products

• Onepeloton Ttr01 Firmware: through ptv55g

References

• https://fccid.io/2AA3N-TTR01
• https://www.mcafee.com/blogs/consumer/mobile-and-iot-security/is-your-peloton-spinning-up-malware/
• https://youtu.be/RLjXfvb0ADw
• https://fccid.io/2AA3N-TTR01
• https://www.mcafee.com/blogs/consumer/mobile-and-iot-security/is-your-peloton-spinning-up-malware/
• https://youtu.be/RLjXfvb0ADw

Get alerted when CVE-2021-33887 or the next vulnerability affects your stack