CVE-2021-33879: tencent gameloop Download of Code Without Integrity Check
Vulnerability summary
CVE-2021-33879 is a high (CVSS 8.1) Download of Code Without Integrity Check vulnerability in tencent gameloop. EPSS estimates a 1.20% chance of exploitation in the next 30 days, higher than 68.2% of scored vulnerabilities. 1 public exploit is recorded.
Public exploit (GitHub, Date unknown)
Source freshness unavailable
How is this decided?Timeline
- 06-06-2021PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
Tencent GameLoop before 4.1.21.90 downloaded updates over an insecure HTTP connection. A malicious attacker in an MITM position could spoof the contents of an XML document describing an update package, replacing a download URL with one pointing to an arbitrary Windows executable. Because the only integrity check would be a comparison of the downloaded file's MD5 checksum to the one contained within the XML document, the downloaded executable would then be executed on the victim's machine.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
1.20%
Chance of exploitation in the next 30 days
Percentile
68%
Versus all other CVEs
30-day change
Increase +0.18 pp
From 1.02% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundCve 2021 33879
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Tencent1 product
- gameloop< 4.1.21.90
1 vendor · 1 product