CVE-2021-42338: 4MOSAn GCB Doctor - Improper Authorization

Severity: critical (CVSS 10.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 5.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-11-19 · updated 2026-06-17
Weakness: CWE-285

Description

4MOSAn GCB Doctor’s login page has improper validation of Cookie, which allows an unauthenticated remote attacker to bypass authentication by code injection in cookie, and arbitrarily manipulate the system or interrupt services by upload and execution of arbitrary files.

Affected products

4MOSAn GCB Doctor: through 20210708

References

https://www.twcert.org.tw/tw/cp-132-5313-45bde-1.html
https://www.twcert.org.tw/tw/cp-132-5313-45bde-1.html

Get alerted when CVE-2021-42338 or the next vulnerability affects your stack