How severe is CVE-2021-30173?

CVE-2021-30173 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity none, and availability none.

Is CVE-2021-30173 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (65th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2021-30173?

CVE-2021-30173 affects Junhetec Omnidirectional Communication System. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2021-30173?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2021-30173 published?

CVE-2021-30173 was published on 2021-05-07 and last updated on 2026-06-17.

CVE-2021-30173

CVE-2021-30173 is a medium-severity vulnerability in Junhetec Omnidirectional Communication System with a CVSS 3.x base score of 6.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-36.

Key facts

Severity: Medium (CVSS 3.x base score 6.5)
CVSS v2: 4.0
EPSS exploit prediction: 1% (65th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-36
Affected product: Junhetec Omnidirectional Communication System
Published: 2021-05-07
Last modified: 2026-06-17

Description

Local File Inclusion vulnerability of the omni-directional communication system allows remote authenticated attacker inject absolute path into Url parameter and access arbitrary file.

Frequently asked questions

What is CVE-2021-30173?: Local File Inclusion vulnerability of the omni-directional communication system allows remote authenticated attacker inject absolute path into Url parameter and access arbitrary file.
How severe is CVE-2021-30173?: CVE-2021-30173 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity none, and availability none.
Is CVE-2021-30173 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (65th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2021-30173?: CVE-2021-30173 affects Junhetec Omnidirectional Communication System. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2021-30173?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2021-30173 published?: CVE-2021-30173 was published on 2021-05-07 and last updated on 2026-06-17.

References

https://www.twcert.org.tw/tw/cp-132-4712-7ade4-1.html

Affected products (1)

cpe:2.3:a:junhetec:omnidirectional_communication_system:2007.2103:*:*:*:*:*:*:*

More vulnerabilities in Junhetec Omnidirectional Communication System

CVE-2021-30172 — Medium (CVSS 4.6): Special characters of picture preview page in the Quan-Fang-Wei-Tong-Xun system are not filtered in users’ input,…

All CVEs affecting Junhetec Omnidirectional Communication System →

Other CWE-36 vulnerabilities

CVE-2023-3765 — Critical (CVSS 10.0): Absolute Path Traversal in GitHub repository mlflow/mlflow prior to 2.5.0.
CVE-2025-34392 — Critical (CVSS 9.8): Barracuda Service Center, as implemented in the RMM solution, in versions prior to 2025.1.1, does not verify the URL…
CVE-2025-0851 — Critical (CVSS 9.8): A path traversal issue in ZipUtils.unzip and TarUtils.untar in Deep Java Library (DJL) on all platforms allows a bad…
CVE-2024-13161 — Critical (CVSS 9.8): Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security…
CVE-2024-13160 — Critical (CVSS 9.8): Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security…
CVE-2024-13159 — Critical (CVSS 9.8): Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security…

Browse all CWE-36 vulnerabilities →