CVE Catalog
CVE-2021-27132
CriticalCVSS 9.8Exploitation Probability (EPSS)
Very high risk16.06%
97th percentile - higher than 97% of all known CVEs
Summary
SerComm AG Combo VD625 devices running AGSOT_2.1.0 are vulnerable to CRLF injection in the download function via the Content-Disposition header. This allows an attacker to inject arbitrary HTTP headers.
Risk Assessment
The risk includes HTTP response splitting attacks, which can lead to session hijacking, cache poisoning, or serving malicious content to users.
Recommendation
Update the firmware of SerComm AG Combo VD625 devices to the latest version that fixes the CRLF injection vulnerability. As a workaround, restrict access to the download function to trusted users only.
Original NVD description (English source)
SerComm AG Combo VD625 AGSOT_2.1.0 devices allow CRLF injection (for HTTP header injection) in the download function via the Content-Disposition header.