Medium severity · published Mar 25, 2022
CVE-2021-44751
A vulnerability affecting F-Secure SAFE browser was discovered
5.3
CVSS
0.6%
EPSS
No
On KEV
Description
A vulnerability affecting F-Secure SAFE browser was discovered. A maliciously crafted website attached with USSD code in JavaScript or iFrame can trigger dialer application from F-Secure browser which can be exploited by an attacker to send unwanted USSD messages or perform unwanted calls. In most modern Android OS, dialer application will require user interaction, however, some older Android OS may not need user interaction.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 47% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SA
Safe · F-secure
before 18.5 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-44751
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-44751
Not Applicable
https://www.f-secure.com/en/business/programs/vulnerability-reward-program/hall-of-fame
More from Safe
9.6
CVE-2021-44749
A vulnerability affecting F-Secure SAFE browser protection was discovered improper URL handling can be triggered to cause universal cross-site scripting through browsing…
8.8
CVE-2022-28872
A vulnerability affecting F-Secure SAFE browser was discovered
8.1
CVE-2020-14978
An issue was discovered in F-Secure SAFE 17.7 on macOS
8.1
CVE-2020-14977
An issue was discovered in F-Secure SAFE 17.7 on macOS
7.8
CVE-2019-11644
In the F-Secure installer in F-Secure SAFE for Windows before 17.6, F-Secure Internet Security before 17.6, F-Secure Anti-Virus before 17.6, F-Secure Client Security Standard and…