CVE-2021-31575: mediatek, inc. en7528, en7580 Command Injection

Vulnerability summary

CVE-2021-31575 is a critical (CVSS 9.8) Command Injection vulnerability in mediatek, inc. en7528, en7580. EPSS estimates a 1.68% chance of exploitation in the next 30 days, higher than 76.5% of scored vulnerabilities.

Timeline

1. 06-02-2023
   PublishedVulnerability first disclosed.
2. 26-03-2025
   Last modifiedVulnerability information updated.

Description

In Config Manager, there is a possible command injection due to improper input validation. This could lead to remote escalation of privilege from a proximal attacker with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: A20210009; Issue ID: OSBNB00123234.

• CWE-77Improper Neutralization of Special Elements used in a Command ('Command Injection')The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.