{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-04-19T03:43:09.628","vulnerabilities":[{"cve":{"id":"CVE-2021-20139","sourceIdentifier":"vulnreport@tenable.com","published":"2021-12-09T16:15:07.843","lastModified":"2024-11-21T05:45:59.900","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"An unauthenticated command injection vulnerability exists in the parameters of operation 3 in the controller_server service on Gryphon Tower routers. An unauthenticated remote attacker on the same network can execute commands as root on the device by sending a specially crafted malicious packet to the controller_server service on port 9999."},{"lang":"es","value":"Se presenta una vulnerabilidad de inyección de comandos no autenticada en los parámetros de la operación 3 del servicio controller_server en los routers Gryphon Tower. Un atacante remoto no autenticado en la misma red puede ejecutar comandos como root en el dispositivo mediante el envío de un paquete malicioso especialmente diseñado al servicio controller_server en el puerto 9999"}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:A/AC:L/Au:N/C:C/I:C/A:C","baseScore":8.3,"accessVector":"ADJACENT_NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":6.5,"impactScore":10.0,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-78"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:gryphonconnect:gryphon_tower_firmware:*:*:*:*:*:*:*:*","versionEndIncluding":"04.0004.12","matchCriteriaId":"F0E6D9AA-BA55-417C-9AA7-12FDA077BB49"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:gryphonconnect:gryphon_tower:-:*:*:*:*:*:*:*","matchCriteriaId":"85AD2611-183D-4ACE-AF89-0E1B29CE1371"}]}]}],"references":[{"url":"https://www.tenable.com/security/research/tra-2021-51","source":"vulnreport@tenable.com","tags":["Exploit","Vendor Advisory"]},{"url":"https://www.tenable.com/security/research/tra-2021-51","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Vendor Advisory"]}]}}]}