Security Advisory

CVE-2021-41583

CVE vulnerability detail — eXtreme Datacenter Security Operations

Published 2021-09-24 02:22:03

Last updated 2024-08-04 03:15:29

Assigner mitre

State PUBLISHED

Description

vpn-user-portal (aka eduVPN or Lets Connect!) before 2.3.14, as packaged for Debian 10, Debian 11, and Fedora, allows remote authenticated users to obtain OS filesystem access, because of the interaction of QR codes with an exec that uses the -r option. This can be leveraged to obtain additional VPN access.

← Browse all CVEs View on cve.org ↗