Skip to content
OpenAdvisories
Critical VDE-2021-057 2 CVEs

Helmholz: Privilege Escalation in shDialup (Update A)

Published Mar 28, 2021 · Updated May 14, 2025 · Revision 2

Vendor: Helmholz Product: shDialup

Summary

Multiple Vulnerabilities in a software service of shDIALUP can lead to arbitrary code execution due to improper privilege management.

Update A, 2022-03-28

Updated CVSS score from CVE-2021-33527 from 7.8 to 9.8 due to new information about the vulnerability

Details

Impact
Please consult the CVE entries.

Remediation
Update shDialup to 3.9R0.5

Vulnerabilities 2

  • Critical 9.8
    CVE-2021-33527

    OS Command Injection in mbDIALUP <= 3.9R0.0

    In MB connect line mbDIALUP versions <= 3.9R0.0 a remote attacker can send a specifically crafted HTTP request to the service running with NT AUTHORITY\SYSTEM that will not correctly validate the input. This can lead to an arbitrary code execution with the pr…

    MB connect line mbDIALUP
  • High 7.8
    CVE-2021-33526

    Privilege escalation in mbDIALUP <= 3.9R0.0

    In MB connect line mbDIALUP versions <= 3.9R0.0 a low privileged local attacker can send a command to the service running with NT AUTHORITY\SYSTEM instructing it to execute a malicous OpenVPN configuration resulting in arbitrary code execution with the privil…

    MB connect line mbDIALUP

Revision history

  1. #2

    Fix: added distribution

  2. #1

    initial revision

References