How severe is CVE-2021-42375?

CVE-2021-42375 has a CVSS 3.x base score of 5.5, rated medium severity. It is exploitable over local access with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.

Is CVE-2021-42375 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (30th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2021-42375?

CVE-2021-42375 primarily affects Busybox. In total, 13 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2021-42375?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2021-42375 published?

CVE-2021-42375 was published on 2021-11-15 and last updated on 2026-06-17.

CVE-2021-42375

CVE-2021-42375 is a medium-severity vulnerability in Busybox with a CVSS 3.x base score of 5.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-159.

Key facts

Severity: Medium (CVSS 3.x base score 5.5)
CVSS v2: 1.9
EPSS exploit prediction: 0% (30th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-159
Affected product: Busybox
Published: 2021-11-15
Last modified: 2026-06-17

Description

An incorrect handling of a special element in Busybox's ash applet leads to denial of service when processing a crafted shell command, due to the shell mistaking specific characters for reserved characters. This may be used for DoS under rare conditions of filtered command input.

Frequently asked questions

What is CVE-2021-42375?: An incorrect handling of a special element in Busybox's ash applet leads to denial of service when processing a crafted shell command, due to the shell mistaking specific characters for reserved characters. This may be used for DoS under rare conditions of filtered command input.
How severe is CVE-2021-42375?: CVE-2021-42375 has a CVSS 3.x base score of 5.5, rated medium severity. It is exploitable over local access with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.
Is CVE-2021-42375 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (30th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2021-42375?: CVE-2021-42375 primarily affects Busybox. In total, 13 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2021-42375?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2021-42375 published?: CVE-2021-42375 was published on 2021-11-15 and last updated on 2026-06-17.

References

Affected products (13)

cpe:2.3:a:busybox:busybox:1.33.1:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:h300e_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:h500e_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:h700e_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*

More vulnerabilities in Busybox

CVE-2022-48174 — Critical (CVSS 9.8): There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of…
CVE-2021-42377 — Critical (CVSS 9.8): An attacker-controlled pointer free in Busybox's hush applet leads to denial of service and possible code execution…
CVE-2018-1000517 — Critical (CVSS 9.8): BusyBox project BusyBox wget version prior to commit 8e2174e9bd836e53c8b9c6e00d1bc6e2a718686e contains a Buffer…
CVE-2016-2148 — Critical (CVSS 9.8): Heap-based buffer overflow in the DHCP client (udhcpc) in BusyBox before 1.25.0 allows remote attackers to have…
CVE-2022-28391 — High (CVSS 8.8): BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's…
CVE-2017-16544 — High (CVSS 8.8): In the add_match function in libbb/lineedit.c in BusyBox through 1.27.2, the tab autocomplete feature of the shell,…

All CVEs affecting Busybox →

Other CWE-159 vulnerabilities

CVE-2019-9505 — Critical (CVSS 9.8): The PrinterLogic Print Management software, versions up to and including 18.3.1.96, does not sanitize special…
CVE-2020-1648 — High (CVSS 7.5): On Juniper Networks Junos OS and Junos OS Evolved devices, processing a specific BGP packet can lead to a routing…
CVE-2020-1646 — High (CVSS 7.5): On Juniper Networks Junos OS and Junos OS Evolved devices, processing a specific UPDATE for an EBGP peer can lead to a…
CVE-2026-35536 — High (CVSS 7.2): In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesite arguments to…
CVE-2026-2636 — Medium (CVSS 5.5): This vulnerability is caused by a CWE‑159: "Improper Handling of Invalid Use of Special Elements" weakness, which…
CVE-2021-21707 — Medium (CVSS 5.3): In PHP versions 7.3.x below 7.3.33, 7.4.x below 7.4.26 and 8.0.x below 8.0.13, certain XML parsing functions, like…

Browse all CWE-159 vulnerabilities →