Auth bypass in Commax Co., Ltd. Smart Home Ruvie Cctv Bridge Dvr Service
CVE-2021-47709
COMMAX Smart Home System allows an unauthenticated attacker to change configuration and cause denial-of-service through the setconf endpoint. Attackers can trigger a denial-of-service scenario by sending a malformed request to the setconf endpoint.
Vulnerability class: Broken Authentication
Published · last modified .
EPSS exploit prediction
EPSS: 0.004 (26.3th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 26th percentile — 26.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.003 · newest: 0.004 · change: +0.000
Affected products
Weakness classification (CWE)
References
- www.exploit-db.com/exploits/50209 (exploit)
- www.commax.com (product)
- www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5666.php (third-party-advisory)
- www.vulncheck.com/advisories/commax-smart-home-ruvie-cctv-bridge-dvr-service-co… (third-party-advisory)