What’s Vulnerable › Vulnerabilities

CVE-2021-40222

• Severity: high (CVSS 7.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 4.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-09-09 · updated 2026-06-17
• Weakness: CWE-78

Description

Rittal CMC PU III Web management Version affected: V3.11.00_2. Version fixed: V3.17.10 is affected by a remote code execution vulnerablity. It is possible to introduce shell code to create a reverse shell in the PU-Hostname field of the TCP/IP Configuration dialog. Web application fails to sanitize user input on Network TCP/IP configuration page. This allows the attacker to inject commands as root on the device which will be executed once the data is received.

Affected products

• Rittal Cmc Pu Iii 7030.000 Firmware: from 3.11.00_2 before 3.17.10 — fixed in 3.17.10

How to fix

Upgrade to a fixed version: Rittal Cmc Pu Iii 7030.000 Firmware 3.17.10. Check the vendor advisory for mitigations.

References

• https://github.com/asang17/CVE-2021-RCE
• https://github.com/asang17/CVE-2021-RCE

Get alerted when CVE-2021-40222 or the next vulnerability affects your stack