What’s Vulnerable › Vulnerabilities

CVE-2021-41316

• Severity: high (CVSS 8.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-09-17 · updated 2026-06-17
• Weakness: CWE-88

Description

The Device42 Main Appliance before 17.05.01 does not sanitize user input in its Nmap Discovery utility. An attacker (with permissions to add or edit jobs run by this utility) can inject an extra argument to overwrite arbitrary files as the root user on the Remote Collector.

Affected products

• Device42: before 17.05.01 — fixed in 17.05.01

How to fix

Upgrade to a fixed version: Device42 17.05.01. Check the vendor advisory for mitigations.

References

• https://blog.device42.com/2021/09/critical-fixes-in-17-05-01/
• https://docs.device42.com/auto-discovery/nmap-autodiscovery/
• https://docs.device42.com/auto-discovery/remote-collector-rc/
• https://blog.device42.com/2021/09/critical-fixes-in-17-05-01/
• https://docs.device42.com/auto-discovery/nmap-autodiscovery/
• https://docs.device42.com/auto-discovery/remote-collector-rc/

Get alerted when CVE-2021-41316 or the next vulnerability affects your stack