CVE-2021-46354

HighCVSS 7.5

Published: 09/02/2022(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Very high risk

12.79%

96th percentile - higher than 96% of all known CVEs

Summary

An information disclosure vulnerability in Thinfinity VirtualUI 2.1.28.0, 2.1.32.1 and 2.5.26.2, fixed in version 3.0, affects the parameter "Addr" in cmd site. It allows sending requests to other systems, potentially revealing the real IP of the web server or increasing the attack surface.

Risk Assessment

The risk involves potential disclosure of the real IP address of the web server, which could facilitate targeted attacks or increase the attack surface by using the server to send requests to other systems.

Recommendation

It is recommended to immediately update Thinfinity VirtualUI to version 3.0 or later, which fixes this vulnerability.

Original NVD description (English source)

Thinfinity VirtualUI 2.1.28.0, 2.1.32.1 and 2.5.26.2, fixed in version 3.0 is affected by an information disclosure vulnerability in the parameter "Addr" in cmd site. The ability to send requests to other systems can allow the vulnerable server to filtrate the real IP of the web server or increase the attack surface.