VYPR
← All advisories
Critical severityNVD Advisory· Published Mar 6, 2022· Updated Aug 4, 2024

CVE-2021-46704

CVE-2021-46704

Description

Unauthenticated OS command injection in GenieACS UI ping API allows remote code execution.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Unauthenticated OS command injection in GenieACS UI ping API allows remote code execution.

Vulnerability

In GenieACS 1.2.x before 1.2.8, the UI interface API (lib/ui/api.ts and lib/ping.ts) is vulnerable to unauthenticated OS command injection. The ping host argument is passed directly to the system's ping command without proper validation or authorization checks. [1] [3]

Exploitation

An unauthenticated attacker can send a crafted HTTP request to the UI API's ping endpoint with a malicious host argument containing shell metacharacters. Because the host is passed to exec() without sanitization, arbitrary commands are executed on the server. [1] [3]

Impact

Successful exploitation allows remote code execution as the user running genieacs-ui (typically root or a low-privilege user). This can lead to full compromise of the ACS server and potentially the managed devices. [1]

Mitigation

The vulnerability is fixed in GenieACS version 1.2.8. The fix adds input validation via a isValidHost function that restricts allowed characters. [3] [4] Users should upgrade to 1.2.8 or later. No workarounds are documented.

References
  1. NVD - CVE-2021-46704
  2. Validate host arg passed to ping · genieacs/genieacs@7f295be
  3. Release v1.2.8 · genieacs/genieacs

AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
genieacsnpm
< 1.2.81.2.8

Affected products

2

Patches

1
7f295beeecc1

Validate host arg passed to ping

https://github.com/genieacs/genieacsZaid AbdullaOct 14, 2021via ghsa
commit
1 file changed · +13 −0
  • lib/ping.ts+13 −0 modified
    @@ -19,6 +19,7 @@
 
 import { platform } from "os";
 import { exec } from "child_process";
+import { domainToASCII } from "url";
 
 export interface PingResult {
   packetsTransmitted: number;
@@ -30,11 +31,23 @@ export interface PingResult {
   mdev: number;
 }
 
+function isValidHost(host: string): boolean {
+  // Valid chars in IPv4, IPv6, domain names
+  if (/^[a-zA-Z0-9\-.:[\]-]+$/.test(host)) return true;
+
+  // Check if input is an IDN convert to Punycode
+  // Can't merge with above because domainToASCII doesn't accept IP addresses
+  return /^[a-zA-Z0-9\-.:[\]-]+$/.test(domainToASCII(host));
+}
+
 export function ping(
   host: string,
   callback: (err: Error, res?: PingResult, stdout?: string) => void
 ): void {
   let cmd: string, parseRegExp1: RegExp, parseRegExp2: RegExp;
+  // Validate input to prevent possible remote code execution
+  // Credit to Alex Hordijk for reporting this vulnerability
+  if (!isValidHost(host)) return callback(new Error("Invalid host"));
   host = host.replace("[", "").replace("]", "");
   switch (platform()) {
     case "linux":

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

4

News mentions

0

No linked articles in our index yet.