.. / CVE-2021-27561

• RCE
• Nuclei
• Web

Exploit for YeaLink DM 3.6.0.20 - Remote Command Injection (CVE-2021-27561)

Description:

Yealink Device Management (DM) 3.6.0.20 allows command injection as root via the /sm/api/v1/firewall/zone/services URI, without authentication.

Nuclei Template

View the template here CVE-2021-27561.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2021/CVE-2021-27561.yaml

References: