High severity · published Nov 8, 2021
CVE-2021-42372
A shell command injection in the HW Events SNMP community in XoruX LPAR2RRD and STOR2RRD before 7.30 allows authenticated remote attackers to execute arbitrary shell commands as…
8.8
CVSS
6.1%
EPSS
No
On KEV
Description
A shell command injection in the HW Events SNMP community in XoruX LPAR2RRD and STOR2RRD before 7.30 allows authenticated remote attackers to execute arbitrary shell commands as the user running the service.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)6.1% · higher than 93% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LP
Lpar2rrd · Xorux
before 7.30 · source: NVD
ST
Stor2rrd · Xorux
before 7.30 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-42372
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-42372
Exploit
https://github.com/orangecertcc/security-research/security/advisories/GHSA-xfw3-pgp3-5j2p
Release Notes
https://lpar2rrd.com/note730.php
Release Notes
https://stor2rrd.com/note730.php
More from Lpar2rrd
9.8
CVE-2021-42371
lpar2rrd is a hardcoded system account in XoruX LPAR2RRD and STOR2RRD before 7.30
9.8
CVE-2020-24032
tz.pl on XoruX LPAR2RRD and STOR2RRD 2.70 virtual appliances allows cmd=set&tz=OS command injection via shell metacharacters in a timezone
9.8
CVE-2014-4981
LPAR2RRD in 3.5 and earlier allows remote attackers to execute arbitrary commands due to insufficient input sanitization of the web GUI parameters
9.8
CVE-2014-4982
LPAR2RRD ≤ 4.53 and ≤ 3.5 has arbitrary command injection on the application server
8.8
CVE-2025-54769
KL-001-2025-016: Xorux LPAR2RRD File Upload Directory Traversal