Week 52, 2021
27 December 2021 – 2 January 2022
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
- Critical 9.8 EPSS 56%
-
Critical 9.8
CVE-2021-45956 Dnsmasq 2.86 has a heap-based buffer overflow in print_mac (called from log_packet and dhcp_reply). NOTE: the vendor's position is that CVE-2021-45951 through …EPSS 2.7%
- Critical 9.8
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
Medium 6.6
CVE-2021-44832 Apache Log4j2 vulnerable to RCE via JDBC Appender when attacker controls configurationEPSS 98%
- Unscored EPSS 86%
-
Unscored
CVE-2021-20150 Trendnet AC2600 TEW-827DRU version 2.08B01 improperly discloses information via redirection from the setup wizard. Authentication can be bypassed and a user ma…EPSS 40%
- High 8.8 EPSS 35%
-
Unscored
CVE-2021-45427 Emerson XWEB 300D EVO 3.0.7--3ee403 is affected by: unauthenticated arbitrary file deletion due to path traversal. An attacker can browse and delete files with…EPSS 19%
-
Unscored
CVE-2021-20158 Trendnet AC2600 TEW-827DRU version 2.08B01 contains an authentication bypass vulnerability. It is possible for an unauthenticated, malicous actor to force the …EPSS 9.6%
-
Unscored
CVE-2021-20134 Quagga Services on D-Link DIR-2640 less than or equal to version 1.11B02 are affected by an absolute path traversal vulnerability that allows a remote, authent…EPSS 7.8%
-
Unscored
CVE-2021-20167 Netgear RAX43 version 1.0.3.96 contains a command injection vulnerability. The readycloud cgi application is vulnerable to command injection in the name parame…EPSS 7%
Advisories
- Debian Security (DSA / DLA) 252 critical
- SUSE / openSUSE Security Updates 212 critical
- BSI CERT-Bund (WID) 5
- Siemens ProductCERT 1
- openSUSE-SU-2021:1635-1 Security update for MozillaThunderbird 33 CVEs
- DSA-5034-1 thunderbird - security update 25 CVEs
- DLA-2860-1 paramiko - security update 2 CVEs
- openSUSE-SU-2021:1645-1 Security update for getdata 1 CVEs