CVE-2021-32089

An issue was discovered on Zebra (formerly Motorola Solutions) Fixed RFID Reader FX9500 devices. An unauthenticated attacker can upload arbitrary files to the filesystem that can then be accessed through the web interface. This can lead to information disclosure and code execution. NOTE: This vulnerability only affects products that are no longer supported by the maintainer

CVSS v3 9.8 CRITICAL
CVSS v2.0 7.5 HIGH

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://www.securifera.com/advisories/cve-2021-32089/	Third Party Advisory
https://www.zebra.com/us/en/support-downloads/rfid/rfid-readers/fx9500.html	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:zebra:fx9500_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:zebra:fx9500:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2021-05-11 21:15

Updated : 2024-05-17 01:57

NVD link : CVE-2021-32089

Mitre link : CVE-2021-32089

CVE.ORG link : CVE-2021-32089

JSON object : View

Products Affected

zebra

fx9500
fx9500_firmware

CWE

CWE-434

Unrestricted Upload of File with Dangerous Type

{"id": "CVE-2021-32089", "cveTags": [{"tags": ["unsupported-when-assigned"], "sourceIdentifier": "cve@mitre.org"}], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2021-05-11T21:15:08.023", "references": [{"url": "https://www.securifera.com/advisories/cve-2021-32089/", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.zebra.com/us/en/support-downloads/rfid/rfid-readers/fx9500.html", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-434"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered on Zebra (formerly Motorola Solutions) Fixed RFID Reader FX9500 devices. An unauthenticated attacker can upload arbitrary files to the filesystem that can then be accessed through the web interface. This can lead to information disclosure and code execution. NOTE: This vulnerability only affects products that are no longer supported by the maintainer"}, {"lang": "es", "value": "** NO SOPORTADO CUANDO SE ASIGN\u00d3 ** Se detect\u00f3 un problema en los dispositivos Zebra (anteriormente Motorola Solutions) Fixed RFID Reader FX9500. Un atacante no autenticado puede cargar archivos arbitrarios en el sistema de archivos a los que luego puede ser accedido por medio de la interfaz web. Esto puede conllevar a una divulgaci\u00f3n de informaci\u00f3n y la ejecuci\u00f3n de c\u00f3digo. NOTA: Esta vulnerabilidad solo afecta a productos que ya no son compatibles con el mantenedor"}], "lastModified": "2024-05-17T01:57:27.660", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:zebra:fx9500_firmware:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EE72F22C-1242-4D9C-ABF2-022E0E6E051F"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:zebra:fx9500:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "FEC6DAEB-396B-46D1-9B6F-B1493B751434"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}