What’s Vulnerable › Vulnerabilities

CVE-2021-37471

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.2% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-11-07 · updated 2026-06-17

Description

Cradlepoint IBR900-600 devices running versions < 7.21.10 are vulnerable to a restricted shell escape sequence that provides an attacker the capability to simultaneously deny availability to the device's NetCloud Manager console, local console and SSH command-line.

Affected products

• Cradlepoint Ibr600 Firmware: before 7.21.0 — fixed in 7.21.0
• Cradlepoint Ibr600C Firmware: before 7.21.0 — fixed in 7.21.0
• Cradlepoint Ibr900 Firmware: before 7.21.0 — fixed in 7.21.0

How to fix

Upgrade to a fixed version: Cradlepoint Ibr600 Firmware 7.21.0; Cradlepoint Ibr600C Firmware 7.21.0; Cradlepoint Ibr900 Firmware 7.21.0. Check the vendor advisory for mitigations.

References

• https://cradlepoint.com/product/endpoints/ibr900/
• https://securitybytes.me/posts/cve-2021-37471/
• https://cradlepoint.com/product/endpoints/ibr900/
• https://securitybytes.me/posts/cve-2021-37471/

Get alerted when CVE-2021-37471 or the next vulnerability affects your stack