CVE

CVE-2021-28149

6.5

CVSS

Description

Hongdian H8922 3.0.5 devices allow Directory Traversal. The /log_download.cgi log export handler does not validate user input and allows a remote attacker with minimal privileges to download any file from the device by substituting ../ (e.g., ../../etc/passwd) This can be carried out with a web browser by changing the file name accordingly. Upon visiting log_download.cgi?type=../../etc/passwd and logging in, the web server will allow a download of the contents of the /etc/passwd file.

Attack Vector

Privileges Req.

User Interaction

Updated Sep 26, 2026View on NVD →

S4E scanner

mediumProduct Based Web Vulnerabilities~10 seconds

CVE-2021-28149 Scanner

CVE-2021-28149 scanner - Directory Traversal vulnerability in Hongdian H8922

Used 3.4k times · 3.3k assets checked · domain, ipv4, subdomain

Scanner page →Run scanner

Monitor this CVE on your assets

S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.

Create a free account →