What’s Vulnerable › Vulnerabilities

CVE-2021-43175

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.2% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-12-07 · updated 2026-06-17
• Weakness: CWE-305

Description

The GOautodial API prior to commit 3c3a979 made on October 13th, 2021 exposes an API router that accepts a username, password, and action that routes to other PHP files that implement the various API functions. Vulnerable versions of GOautodial validate the username and password incorrectly, allowing the caller to specify any values for these parameters and successfully authenticate. CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C

Affected products

• GOautodial: 4
• GOautodial API: 2

References

• https://www.synopsys.com/blogs/software-security/cyrc-advisory-goautodial-vulnerabilities
• https://www.synopsys.com/blogs/software-security/cyrc-advisory-goautodial-vulnerabilities

Get alerted when CVE-2021-43175 or the next vulnerability affects your stack