High severity8.8NVD Advisory· Published Jun 9, 2021· Updated Jun 17, 2026
CVE-2021-33393
CVE-2021-33393
Description
lfs/backup in IPFire 2.25-core155 does not ensure that /var/ipfire/backup/bin/backup.pl is owned by the root account. It might be owned by an unprivileged account, which could potentially be used to install a Trojan horse backup.pl script that is later executed by root. Similar problems with the ownership/permissions of other files may be present as well.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
17cpe:2.3:a:ipfire:ipfire:*:*:*:*:*:*:*:*+ 15 more
- cpe:2.3:a:ipfire:ipfire:*:*:*:*:*:*:*:*range: <2.25
- cpe:2.3:a:ipfire:ipfire:2.25:core_update141:*:*:*:*:*:*
- cpe:2.3:a:ipfire:ipfire:2.25:core_update142:*:*:*:*:*:*
- cpe:2.3:a:ipfire:ipfire:2.25:core_update143:*:*:*:*:*:*
- cpe:2.3:a:ipfire:ipfire:2.25:core_update144:*:*:*:*:*:*
- cpe:2.3:a:ipfire:ipfire:2.25:core_update145:*:*:*:*:*:*
- cpe:2.3:a:ipfire:ipfire:2.25:core_update146:*:*:*:*:*:*
- cpe:2.3:a:ipfire:ipfire:2.25:core_update147:*:*:*:*:*:*
- cpe:2.3:a:ipfire:ipfire:2.25:core_update148:*:*:*:*:*:*
- cpe:2.3:a:ipfire:ipfire:2.25:core_update149:*:*:*:*:*:*
- cpe:2.3:a:ipfire:ipfire:2.25:core_update150:*:*:*:*:*:*
- cpe:2.3:a:ipfire:ipfire:2.25:core_update151:*:*:*:*:*:*
- cpe:2.3:a:ipfire:ipfire:2.25:core_update152:*:*:*:*:*:*
- cpe:2.3:a:ipfire:ipfire:2.25:core_update155:*:*:*:*:*:*
- cpe:2.3:a:ipfire:ipfire:2.25:core_update156:*:*:*:*:*:*
- (no CPE)range: 2.25-core155
- IPFire/IPFiredescription
Patches
Vulnerability mechanics
References
3- github.com/ipfire/ipfire-2.x/commit/6769d909306d7bdc43d64598872126fcf1b217f6nvdPatchThird Party Advisory
- packetstormsecurity.com/files/163158/IPFire-2.25-Remote-Code-Execution.htmlnvdExploitThird Party AdvisoryVDB Entry
- github.com/ipfire/ipfire-2.x/commits/masternvdThird Party Advisory
News mentions
0No linked articles in our index yet.