How severe is CVE-2021-47718?

CVE-2021-47718 has a CVSS 3.x base score of 7.5, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity none, and availability none.

Is CVE-2021-47718 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (38th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2021-47718?

CVE-2021-47718 affects Openbmcs. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2021-47718?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

Does CVE-2021-47718 have an EU (EUVD) identifier?

Yes. CVE-2021-47718 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2021-34727.

When was CVE-2021-47718 published?

CVE-2021-47718 was published on 2025-12-09 and last updated on 2026-06-17.

CVE-2021-47718

CVE-2021-47718 is a high-severity vulnerability in Openbmcs with a CVSS 3.x base score of 7.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-548.

Key facts

Severity: High (CVSS 3.x base score 7.5)
CVSS v4: 8.7
EPSS exploit prediction: 0% (38th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2021-34727
Weakness: CWE-548
Affected product: Openbmcs
Published: 2025-12-09
Last modified: 2026-06-17

Description

OpenBMCS 2.4 contains an information disclosure vulnerability that allows unauthenticated attackers to access sensitive files by exploiting directory listing functionality. Attackers can browse directories like /debug/ and /php/ to discover configuration files, database credentials, and system information.

Frequently asked questions

What is CVE-2021-47718?: OpenBMCS 2.4 contains an information disclosure vulnerability that allows unauthenticated attackers to access sensitive files by exploiting directory listing functionality. Attackers can browse directories like /debug/ and /php/ to discover configuration files, database credentials, and system information.
How severe is CVE-2021-47718?: CVE-2021-47718 has a CVSS 3.x base score of 7.5, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity none, and availability none.
Is CVE-2021-47718 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (38th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2021-47718?: CVE-2021-47718 affects Openbmcs. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2021-47718?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
Does CVE-2021-47718 have an EU (EUVD) identifier?: Yes. CVE-2021-47718 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2021-34727.
When was CVE-2021-47718 published?: CVE-2021-47718 was published on 2025-12-09 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:openbmcs:openbmcs:2.4:*:*:*:*:*:*:*

More vulnerabilities in Openbmcs

CVE-2021-47701 — High (CVSS 8.8): OpenBMCS 2.4 allows an attacker to escalate privileges from a read user to an admin user by manipulating permissions…
CVE-2021-47703 — High (CVSS 7.2): OpenBMCS 2.4 contains an unauthenticated SSRF vulnerability that allows attackers to bypass firewalls and initiate…
CVE-2021-47704 — Medium (CVSS 6.5): OpenBMCS 2.4 contains an SQL injection vulnerability that allows authenticated attackers to manipulate database queries…
CVE-2021-47702 — Medium (CVSS 4.3): OpenBMCS 2.4 contains a CSRF vulnerability that allows attackers to perform actions with administrative privileges by…

All CVEs affecting Openbmcs →

Other CWE-548 vulnerabilities

CVE-2025-28170 — High (CVSS 7.6): Grandstream Networks GXP1628 <=1.0.4.130 is vulnerable to Incorrect Access Control. The device is configured with…
CVE-2025-32750 — High (CVSS 7.5): Dell PowerFlex Manager, version(s) <=4.6.2, contain(s) an Exposure of Information Through Directory Listing…
CVE-2020-36921 — High (CVSS 7.5): RED-V Super Digital Signage System 5.1.1 contains an information disclosure vulnerability that allows unauthenticated…
CVE-2022-50788 — High (CVSS 7.5): SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x contains an information disclosure vulnerability that allows unauthenticated…
CVE-2024-22082 — High (CVSS 7.5): An issue was discovered in Elspec G5 digital fault recorder versions 1.1.4.15 and before. Unauthenticated directory…
CVE-2023-51948 — High (CVSS 7.5): A Site-wide directory listing vulnerability in /fm in actidata actiNAS SL 2U-8 RDX 3.2.03-SP1 allows remote attackers…

Browse all CWE-548 vulnerabilities →