Search for vulnerabilities
Vulnerability details: VCID-ebet-us66-aaaf
Vulnerability ID VCID-ebet-us66-aaaf
Aliases CVE-2021-42375
Summary An incorrect handling of a special element in Busybox's ash applet leads to denial of service when processing a crafted shell command, due to the shell mistaking specific characters for reserved characters. This may be used for DoS under rare conditions of filtered command input.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (2)
CWE-20 Improper Input Validation
CWE-159 Improper Handling of Invalid Use of Special Elements
System Score Found at
generic_textual Negligible http://people.canonical.com/~ubuntu-security/cve/2021/CVE-2021-42375.html
cvssv3 4.1 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-42375.json
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2021-42375
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2021-42375
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2021-42375
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2021-42375
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2021-42375
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2021-42375
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2021-42375
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2021-42375
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2021-42375
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2021-42375
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2021-42375
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2021-42375
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2021-42375
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2021-42375
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2021-42375
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2021-42375
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2021-42375
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2021-42375
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2021-42375
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2021-42375
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2021-42375
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2021-42375
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2021-42375
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2021-42375
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2021-42375
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2021-42375
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2021-42375
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2021-42375
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2021-42375
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2021-42375
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2021-42375
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2021-42375
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2021-42375
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2021-42375
epss 0.00048 https://api.first.org/data/v1/epss?cve=CVE-2021-42375
epss 0.00048 https://api.first.org/data/v1/epss?cve=CVE-2021-42375
epss 0.00048 https://api.first.org/data/v1/epss?cve=CVE-2021-42375
epss 0.00048 https://api.first.org/data/v1/epss?cve=CVE-2021-42375
epss 0.00048 https://api.first.org/data/v1/epss?cve=CVE-2021-42375
epss 0.00051 https://api.first.org/data/v1/epss?cve=CVE-2021-42375
epss 0.00051 https://api.first.org/data/v1/epss?cve=CVE-2021-42375
epss 0.00051 https://api.first.org/data/v1/epss?cve=CVE-2021-42375
epss 0.00051 https://api.first.org/data/v1/epss?cve=CVE-2021-42375
epss 0.00051 https://api.first.org/data/v1/epss?cve=CVE-2021-42375
epss 0.00051 https://api.first.org/data/v1/epss?cve=CVE-2021-42375
epss 0.00051 https://api.first.org/data/v1/epss?cve=CVE-2021-42375
epss 0.00051 https://api.first.org/data/v1/epss?cve=CVE-2021-42375
epss 0.00051 https://api.first.org/data/v1/epss?cve=CVE-2021-42375
epss 0.00051 https://api.first.org/data/v1/epss?cve=CVE-2021-42375
epss 0.00051 https://api.first.org/data/v1/epss?cve=CVE-2021-42375
epss 0.00051 https://api.first.org/data/v1/epss?cve=CVE-2021-42375
epss 0.00051 https://api.first.org/data/v1/epss?cve=CVE-2021-42375
epss 0.00051 https://api.first.org/data/v1/epss?cve=CVE-2021-42375
epss 0.00051 https://api.first.org/data/v1/epss?cve=CVE-2021-42375
epss 0.00051 https://api.first.org/data/v1/epss?cve=CVE-2021-42375
epss 0.00051 https://api.first.org/data/v1/epss?cve=CVE-2021-42375
epss 0.00051 https://api.first.org/data/v1/epss?cve=CVE-2021-42375
epss 0.00051 https://api.first.org/data/v1/epss?cve=CVE-2021-42375
epss 0.00051 https://api.first.org/data/v1/epss?cve=CVE-2021-42375
epss 0.00051 https://api.first.org/data/v1/epss?cve=CVE-2021-42375
epss 0.00051 https://api.first.org/data/v1/epss?cve=CVE-2021-42375
epss 0.00051 https://api.first.org/data/v1/epss?cve=CVE-2021-42375
epss 0.00051 https://api.first.org/data/v1/epss?cve=CVE-2021-42375
epss 0.00051 https://api.first.org/data/v1/epss?cve=CVE-2021-42375
epss 0.00051 https://api.first.org/data/v1/epss?cve=CVE-2021-42375
epss 0.00051 https://api.first.org/data/v1/epss?cve=CVE-2021-42375
epss 0.00051 https://api.first.org/data/v1/epss?cve=CVE-2021-42375
epss 0.00051 https://api.first.org/data/v1/epss?cve=CVE-2021-42375
epss 0.00051 https://api.first.org/data/v1/epss?cve=CVE-2021-42375
epss 0.00051 https://api.first.org/data/v1/epss?cve=CVE-2021-42375
epss 0.00051 https://api.first.org/data/v1/epss?cve=CVE-2021-42375
epss 0.00051 https://api.first.org/data/v1/epss?cve=CVE-2021-42375
epss 0.00051 https://api.first.org/data/v1/epss?cve=CVE-2021-42375
epss 0.00051 https://api.first.org/data/v1/epss?cve=CVE-2021-42375
epss 0.00051 https://api.first.org/data/v1/epss?cve=CVE-2021-42375
epss 0.00051 https://api.first.org/data/v1/epss?cve=CVE-2021-42375
epss 0.00051 https://api.first.org/data/v1/epss?cve=CVE-2021-42375
epss 0.00051 https://api.first.org/data/v1/epss?cve=CVE-2021-42375
epss 0.00051 https://api.first.org/data/v1/epss?cve=CVE-2021-42375
epss 0.00051 https://api.first.org/data/v1/epss?cve=CVE-2021-42375
epss 0.00051 https://api.first.org/data/v1/epss?cve=CVE-2021-42375
epss 0.00051 https://api.first.org/data/v1/epss?cve=CVE-2021-42375
epss 0.00051 https://api.first.org/data/v1/epss?cve=CVE-2021-42375
epss 0.00051 https://api.first.org/data/v1/epss?cve=CVE-2021-42375
epss 0.00051 https://api.first.org/data/v1/epss?cve=CVE-2021-42375
epss 0.00051 https://api.first.org/data/v1/epss?cve=CVE-2021-42375
epss 0.00051 https://api.first.org/data/v1/epss?cve=CVE-2021-42375
epss 0.00051 https://api.first.org/data/v1/epss?cve=CVE-2021-42375
epss 0.00083 https://api.first.org/data/v1/epss?cve=CVE-2021-42375
rhbs medium https://bugzilla.redhat.com/show_bug.cgi?id=2023888
cvssv3.1 5.5 https://claroty.com/team82/research/unboxing-busybox-14-vulnerabilities-uncovered-by-claroty-jfrog
ssvc Track https://claroty.com/team82/research/unboxing-busybox-14-vulnerabilities-uncovered-by-claroty-jfrog
generic_textual Negligible https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42375
cvssv3.1 4.1 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3.1 5.5 https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
generic_textual Low https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
ssvc Track https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
cvssv3.1 5.5 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
ssvc Track https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
cvssv3.1 5.5 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
ssvc Track https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
cvssv2 1.9 https://nvd.nist.gov/vuln/detail/CVE-2021-42375
cvssv3 5.5 https://nvd.nist.gov/vuln/detail/CVE-2021-42375
cvssv3.1 5.5 https://nvd.nist.gov/vuln/detail/CVE-2021-42375
archlinux Medium https://security.archlinux.org/AVG-2561
archlinux Medium https://security.archlinux.org/AVG-2562
cvssv3.1 5.5 https://security.netapp.com/advisory/ntap-20211223-0002/
ssvc Track https://security.netapp.com/advisory/ntap-20211223-0002/
Reference id Reference type URL
http://people.canonical.com/~ubuntu-security/cve/2021/CVE-2021-42375.html
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-42375.json
https://api.first.org/data/v1/epss?cve=CVE-2021-42375
https://claroty.com/team82/research/unboxing-busybox-14-vulnerabilities-uncovered-by-claroty-jfrog
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42375
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
https://security.netapp.com/advisory/ntap-20211223-0002/
2023888 https://bugzilla.redhat.com/show_bug.cgi?id=2023888
999567 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=999567
AVG-2561 https://security.archlinux.org/AVG-2561
AVG-2562 https://security.archlinux.org/AVG-2562
cpe:2.3:a:busybox:busybox:1.33.1:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:busybox:busybox:1.33.1:*:*:*:*:*:*:*
cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
CVE-2021-42375 https://nvd.nist.gov/vuln/detail/CVE-2021-42375
GLSA-202407-17 https://security.gentoo.org/glsa/202407-17
No exploits are available.
Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-42375.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Found at https://claroty.com/team82/research/unboxing-busybox-14-vulnerabilities-uncovered-by-claroty-jfrog
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-23T13:22:05Z/ Found at https://claroty.com/team82/research/unboxing-busybox-14-vulnerabilities-uncovered-by-claroty-jfrog
Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Found at https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-23T13:22:05Z/ Found at https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Found at https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-23T13:22:05Z/ Found at https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Found at https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-23T13:22:05Z/ Found at https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
Vector: AV:L/AC:M/Au:N/C:N/I:N/A:P Found at https://nvd.nist.gov/vuln/detail/CVE-2021-42375
Exploitability (E) Access Vector (AV) Access Complexity (AC) Authentication (Au) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

high

functional

unproven

proof_of_concept

not_defined

local

adjacent_network

network

high

medium

low

multiple

single

none

none

partial

complete

none

partial

complete

none

partial

complete
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2021-42375
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2021-42375
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Found at https://security.netapp.com/advisory/ntap-20211223-0002/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-23T13:22:05Z/ Found at https://security.netapp.com/advisory/ntap-20211223-0002/
Exploit Prediction Scoring System (EPSS)
Percentile 0.15160
EPSS Score 0.00045
Published At Nov. 1, 2024, midnight
Date Actor Action Source VulnerableCode Version
There are no relevant records.