CVE-2021-33393

Status: ModifiedHigh (8.8)—Exploit

Severity8.8High · CVSS 3.1

Exploitation probability59 %higher than 99% of CVEs

Active exploitationNonot in the CISA catalog

Public exploitAvailablePublished on Exploit-DB · Proof of concept on GitHub (unverified) · Metasploit module (reliable, widely available exploit)

lfs/backup in IPFire 2.25-core155 does not ensure that /var/ipfire/backup/bin/backup.pl is owned by the root account. It might be owned by an unprivileged account, which could potentially be used to install a Trojan horse backup.pl script that is later executed by root. Similar problems with the ownership/permissions of other files may be present as well.

CVSS

Base score: 8.8
Version: 3.1
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitation probability (EPSS)

Probability of exploitation in the next 30 days: 59 %
Percentile among all scored CVEs: 99
Score date: 10/27/2026

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Public exploits

Exploit code or detection templates are publicly available. This is not the same as confirmed active exploitation (KEV), but it raises the risk: patch with priority.

Metasploit module (reliable, widely available exploit) · IPFire 2.25 Core Update 156 and Prior pakfire.cgi Authenticated RCE
Published on Exploit-DB · IPFire 2.25 - Remote Code Execution (Authenticated) (5/17/2021)
Proof of concept on GitHub (unverified) · List of proofs of concept on GitHub

⚠️ GitHub proofs of concept are not verified: some are fake or contain malware. Never run them outside an isolated lab.

Affected technologies (1)

Ipfire — Ipfire

CWEs

NVD-CWE-Other

References

Show 8 references

Raw JSON (NVD)

Show

{
  "id": "CVE-2021-33393",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 9,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C",
          "authentication": "SINGLE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2021-06-09T22:15:08.647",
  "references": [
    {
      "url": "http://packetstormsecurity.com/files/163158/IPFire-2.25-Remote-Code-Execution.html",
      "tags": [
        "Exploit",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/MucahitSaratar/ipfire-2-25-auth-rce",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/ipfire/ipfire-2.x/commit/6769d909306d7bdc43d64598872126fcf1b217f6",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/ipfire/ipfire-2.x/commits/master?since=2021-05-17&until=2021-05-17",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://packetstormsecurity.com/files/163158/IPFire-2.25-Remote-Code-Execution.html",
      "tags": [
        "Exploit",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/MucahitSaratar/ipfire-2-25-auth-rce",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/ipfire/ipfire-2.x/commit/6769d909306d7bdc43d64598872126fcf1b217f6",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/ipfire/ipfire-2.x/commits/master?since=2021-05-17&until=2021-05-17",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "lfs/backup in IPFire 2.25-core155 does not ensure that /var/ipfire/backup/bin/backup.pl is owned by the root account. It might be owned by an unprivileged account, which could potentially be used to install a Trojan horse backup.pl script that is later executed by root. Similar problems with the ownership/permissions of other files may be present as well."
    },
    {
      "lang": "es",
      "value": "lfs/backup en IPFire versión 2.25-core155 no asegura que el achivo /var/ipfire/backup/bin/backup.pl sea propiedad de la cuenta root. Podría ser propiedad de una cuenta no privilegiada, lo que podría potencialmente ser usado para instalar un script troyano backup.pl que luego es ejecutado por root. Problemas similares con la propiedad/permisos de otros archivos pueden presentarse también"
    }
  ],
  "lastModified": "2026-06-17T03:54:31.883",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:ipfire:ipfire:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EBDDD8A7-E38C-4AAC-8728-3565419ED2FF",
              "versionEndExcluding": "2.25"
            },
            {
              "criteria": "cpe:2.3:a:ipfire:ipfire:2.25:core_update141:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3B87D3C8-FA28-4F85-AC09-2EFACD6C35BD"
            },
            {
              "criteria": "cpe:2.3:a:ipfire:ipfire:2.25:core_update142:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C1D81A88-D913-4F81-926B-77259697EC62"
            },
            {
              "criteria": "cpe:2.3:a:ipfire:ipfire:2.25:core_update143:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "22756F48-BFA7-4FAB-A5CB-AEFA07AE3CF0"
            },
            {
              "criteria": "cpe:2.3:a:ipfire:ipfire:2.25:core_update144:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A269B061-848F-469C-A339-54562E3732E8"
            },
            {
              "criteria": "cpe:2.3:a:ipfire:ipfire:2.25:core_update145:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2FEDBF86-E999-49AE-B9CF-AEE5779CBCD0"
            },
            {
              "criteria": "cpe:2.3:a:ipfire:ipfire:2.25:core_update146:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3F8CED76-5D01-4E94-B2DF-EB956F011380"
            },
            {
              "criteria": "cpe:2.3:a:ipfire:ipfire:2.25:core_update147:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F00892F6-77F8-46EA-AC9E-6B61D7774F44"
            },
            {
              "criteria": "cpe:2.3:a:ipfire:ipfire:2.25:core_update148:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "795B8D36-67E1-441A-9F13-41A39F437AC0"
            },
            {
              "criteria": "cpe:2.3:a:ipfire:ipfire:2.25:core_update149:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5B0FED14-7C6D-4F36-BBA9-F56AF3A31959"
            },
            {
              "criteria": "cpe:2.3:a:ipfire:ipfire:2.25:core_update150:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C614C0B1-F287-4E63-8D8F-23981375D582"
            },
            {
              "criteria": "cpe:2.3:a:ipfire:ipfire:2.25:core_update151:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9A308567-C944-4D70-9546-3BE15D89F0BE"
            },
            {
              "criteria": "cpe:2.3:a:ipfire:ipfire:2.25:core_update152:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B2E0CD0F-FF88-4EAC-9A5E-0C7DAD479973"
            },
            {
              "criteria": "cpe:2.3:a:ipfire:ipfire:2.25:core_update155:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CFC77F5A-4ADB-4B9F-899D-062B5053D29F"
            },
            {
              "criteria": "cpe:2.3:a:ipfire:ipfire:2.25:core_update156:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0163A797-CA7A-4D4D-AFAE-1A9472F25627"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}