VULNERABILITY INTELLIGENCE
CVE-2021-4466
EPSS probability0.58%
CISA KEVNot currently listed
Published2025-11-14
Last modified2026-06-17
Description
IPCop versions up to and including 2.1.9 contain an authenticated remote code execution vulnerability within the web-based administration interface. The email configuration component inserts user-controlled values, including the EMAIL_PW parameter, directly into system-level operations without proper input sanitation. By modifying the email password field to include shell metacharacters and issuing a save-and-test-mail action, an authenticated attacker can execute arbitrary operating system commands with the privileges of the web interface, resulting in full system compromise.
Weakness classification
- disclosure@vulncheck.com: CWE-78