Week 18, 2021
3–9 May 2021
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
- Critical 9.8 EPSS 100%
- Critical 9.8 EPSS 100%
-
Critical 9.8
CVE-2021-32030 The administrator application on ASUS GT-AC2900 devices before 3.0.0.4.386.42643 and Lyra Mini before 3.0.0.4_384_46630 allows authentication bypass when proce…EPSS 99%
-
Critical 9.8
CVE-2021-31755 An issue was discovered on Tenda AC11 devices with firmware through 02.03.01.104_CN. A stack buffer overflow vulnerability in /goform/setmac allows attackers t…EPSS 87%
- Critical 9.8 EPSS 19%
- Critical 9.8 EPSS 2.1%
-
Critical 9.8
CVE-2021-20204 A heap memory corruption problem (use after free) can be triggered in libgetdata v0.10.0 when processing maliciously crafted dirfile databases. This degrades t…EPSS 2.1%
- Critical 9.8 EPSS 2.1%
- Critical 9.8 EPSS 2%
- Critical 9.8 EPSS 1.8%
- Critical 9.8 EPSS 1.8%
- Critical 9.8 EPSS 1.6%
- Critical 9.8 EPSS 1.6%
- Critical 9.8 EPSS 1.3%
- Critical 9.1
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
- Medium 5.3 EPSS 80%
-
High 8.8
CVE-2021-21551 Dell dbutil_2_3.sys driver contains an insufficient access control vulnerability which may lead to escalation of privileges, denial of service, or information …EPSS 80%
- Medium 5.8 EPSS 70%
-
Unscored
CVE-2021-29203 A security vulnerability has been identified in the HPE Edgeline Infrastructure Manager, also known as HPE Edgeline Infrastructure Management Software, prior t…EPSS 68%
-
Unscored
CVE-2020-28019 Exim 4 before 4.94.2 has Improper Initialization that can lead to recursion-based stack consumption or other consequences. This occurs because use of certain g…EPSS 62%
-
Unscored
CVE-2020-28018 Exim 4 before 4.94.2 allows Use After Free in smtp_reset in certain situations that may be common for builds with OpenSSL.EPSS 56%
-
Unscored
CVE-2020-28017 Exim 4 before 4.94.2 allows Integer Overflow to Buffer Overflow in receive_add_recipient via an e-mail message with fifty million recipients. NOTE: remote expl…EPSS 37%
-
Unscored
CVE-2021-28151 Hongdian H8922 3.0.5 devices allow OS command injection via shell metacharacters into the ip-address (aka Destination) field to the tools.cgi ping command, whi…EPSS 28%
Advisories
- SUSE / openSUSE Security Updates 363 critical
- Ubuntu Security Notices (USN) 11
- Debian Security (DSA / DLA) 101 critical
- BSI CERT-Bund (WID) 7
- CERT@VDE 32 critical
- Oracle Linux Security Advisories (ELSA) 2
- CISA ICS & IT advisories 21 critical
- DLA-2649-1 cgal - security update 45 CVEs
- openSUSE-SU-2021:0677-1 Security update for exim 26 CVEs
- SUSE-SU-2021:1499-1 Security update for webkit2gtk3 10 CVEs
- VDE-2021-013 WAGO: Multiple Vulnerabilities in the Web-Based Management Interface 6 CVEs
- VDE-2021-016 Weidmueller: Accidentally open network port in u-controls and IoT-Gateways 1 CVEs
- openSUSE-SU-2021:0664-1 Security update for gsoap 1 CVEs
- ICSA-21-124-01 Advantech WISE-PaaS RMM 1 CVEs