« Volver al listado

CVE-2021-4459

Estado: AplazadaMedia (6.5)—

An authorized remote attacker can access files and directories outside the intended web root, potentially exposing sensitive system information of the affected Sunny Boy devices.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

SMA — Sunny BOYAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2021-4459",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2021-4459",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-08-27T16:14:11.490021Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "info@cert.vde.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "info@cert.vde.com",
      "affectedData": [
        {
          "vendor": "SMA",
          "product": "Boy 3.0",
          "versions": [
            {
              "status": "affected",
              "version": "0.0.0",
              "lessThan": "3.10.27.R",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "SMA",
          "product": "Boy 3.6",
          "versions": [
            {
              "status": "affected",
              "version": "0.0.0",
              "lessThan": "3.10.27.R",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "SMA",
          "product": "Boy 4.0",
          "versions": [
            {
              "status": "affected",
              "version": "0.0.0",
              "lessThan": "3.10.27.R",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "SMA",
          "product": "Boy 5.0",
          "versions": [
            {
              "status": "affected",
              "version": "0.0.0",
              "lessThan": "3.10.27.R",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "SMA",
          "product": "Boy 6.0",
          "versions": [
            {
              "status": "affected",
              "version": "0.0.0",
              "lessThan": "3.10.27.R",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-08-27T08:15:31.937",
  "references": [
    {
      "url": "https://certvde.com/en/advisories/VDE-2025-066",
      "source": "info@cert.vde.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "info@cert.vde.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-23"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An authorized remote attacker can access files and directories outside the intended web root, potentially exposing sensitive system information of the affected Sunny Boy devices."
    },
    {
      "lang": "es",
      "value": "Un atacante remoto autorizado puede acceder a archivos y directorios fuera del root web previsto, exponiendo potencialmente información confidencial del sistema de los dispositivos Sunny Boy afectados."
    }
  ],
  "lastModified": "2026-06-17T04:19:48.113",
  "sourceIdentifier": "info@cert.vde.com"
}