Vulnerability Details : CVE-2021-41635
When installed as Windows service MELAG FTP Server 2.2.0.4 is run as SYSTEM user, which grants remote attackers to abuse misconfigurations or vulnerabilities with administrative access over the entire host system.
Products affected by CVE-2021-41635
- cpe:2.3:a:melag:ftp_server:2.2.0.4:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2021-41635
0.28%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 68 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2021-41635
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
9.0
|
HIGH | AV:N/AC:L/Au:S/C:C/I:C/A:C |
8.0
|
10.0
|
NIST | |
|
8.8
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
2.8
|
5.9
|
NIST |
CWE ids for CVE-2021-41635
-
During installation, installed file permissions are set to allow anyone to modify those files.Assigned by: nvd@nist.gov (Primary)
References for CVE-2021-41635
-
https://www.securesystems.de/blog/advisory-and-exploitation-the-melag-ftp-server/
Advisory and Exploitation: The MELAG FTP ServerExploit;Third Party Advisory
Jump to