Read the docs
TI-2021-03134 Aliases CVE-2021-4276GHSA-5fqf-v5cm-7jqg

SQL injection in dns-stats hedgehog

Priority LOW 39CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
SQL injection
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-89.

Summary

** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in dns-stats hedgehog. It has been rated as problematic. Affected by this issue is the function DSCIOManager::dsc_import_input_from_source of the file src/DSCIOManager.cpp. The manipulation leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The name of the patch is 58922c345d3d1fe89bb2020111873a3e07ca93ac. It is recommended to apply a patch to fix this issue. VDB-216746 is the identifier assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: We do assume that the Data Manager server can only be accessed by authorised users. Because of this, we don’t believe this specific attack is possible without such a compromise of the Data Manager server.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00654 51st percentileScored 2026-11-07
Fix Fixed hedgehog (dns-stats): 58922c345d3d1fe89bb2020111873a3e07ca93ac

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
dns-statshedgehogbefore 58922c345d3d1fe89bb2020111873a3e07ca93ac58922c345d3d1fe89bb2020111873a3e07ca93acPatch availableCNA
  • hedgehog Vendordns-stats Affected before 58922c345d3d1fe89bb2020111873a3e07ca93ac Fixed in 58922c345d3d1fe89bb2020111873a3e07ca93ac Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:dns-stats:hedgehog:*:*:*:*:*:*:*:*before 2021-05-13Vulnerabledns-stats
  • cpe:2.3:a:dns-stats:hedgehog:*:*:*:*:*:*:*:* Versions before 2021-05-13 Vulnerable ·dns-stats

Remediation

  • Fix · CNA hedgehog (dns-stats) Fixed in 58922c345d3d1fe89bb2020111873a3e07ca93ac

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-4276
  2. 2026-10-03 Alias added: GHSA-5fqf-v5cm-7jqg
  3. 2026-10-25 EPSS moved to the 50th–90th percentile

References

Patch 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences