VITEC Exterity IPTV products through 2021-04-30 allow privilege escalation to root.
Priority MEDIUM 45CWE-1188Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA.
Summary
VITEC Exterity IPTV products through 2021-04-30 allow privilege escalation to root.
Why it matters now
EPSS 0.01664 76th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 19
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:vitec:exterity_avediaserver:*:*:*:*:*:*:*:* | up to 2021-04-30 | Vulnerable | VITEC |
| cpe:2.3:o:vitec:exterity_avediastream_encoders_firmware:*:*:*:*:*:*:*:* | up to 2021-04-30 | Vulnerable | VITEC |
| cpe:2.3:h:vitec:exterity_avediastream_encoders:-:*:*:*:*:*:*:* | not specified by NVD | Running on | VITEC |
| cpe:2.3:o:vitec:avediastream_m9605_firmware:*:*:*:*:*:*:*:* | up to 2021-04-30 | Vulnerable | VITEC |
| cpe:2.3:h:vitec:avediastream_m9605:-:*:*:*:*:*:*:* | not specified by NVD | Running on | VITEC |
| cpe:2.3:o:vitec:avediastream_m9400_firmware:*:*:*:*:*:*:*:* | up to 2021-04-30 | Vulnerable | VITEC |
| cpe:2.3:h:vitec:avediastream_m9400:-:*:*:*:*:*:*:* | not specified by NVD | Running on | VITEC |
| cpe:2.3:o:vitec:avediastream_m9405_firmware:*:*:*:*:*:*:*:* | up to 2021-04-30 | Vulnerable | VITEC |
| cpe:2.3:h:vitec:avediastream_m9405:-:*:*:*:*:*:*:* | not specified by NVD | Running on | VITEC |
| cpe:2.3:o:vitec:avediastream_m9305_firmware:*:*:*:*:*:*:*:* | up to 2021-04-30 | Vulnerable | VITEC |
- cpe:2.3:a:vitec:exterity_avediaserver:*:*:*:*:*:*:*:* Versions up to 2021-04-30 Vulnerable ·VITEC
- cpe:2.3:o:vitec:exterity_avediastream_encoders_firmware:*:*:*:*:*:*:*:* Versions up to 2021-04-30 Vulnerable ·VITEC
- cpe:2.3:h:vitec:exterity_avediastream_encoders:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·VITEC
- cpe:2.3:o:vitec:avediastream_m9605_firmware:*:*:*:*:*:*:*:* Versions up to 2021-04-30 Vulnerable ·VITEC
- cpe:2.3:h:vitec:avediastream_m9605:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·VITEC
- cpe:2.3:o:vitec:avediastream_m9400_firmware:*:*:*:*:*:*:*:* Versions up to 2021-04-30 Vulnerable ·VITEC
- cpe:2.3:h:vitec:avediastream_m9400:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·VITEC
- cpe:2.3:o:vitec:avediastream_m9405_firmware:*:*:*:*:*:*:*:* Versions up to 2021-04-30 Vulnerable ·VITEC
- cpe:2.3:h:vitec:avediastream_m9405:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·VITEC
- cpe:2.3:o:vitec:avediastream_m9305_firmware:*:*:*:*:*:*:*:* Versions up to 2021-04-30 Vulnerable ·VITEC
Show 9 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:h:vitec:avediastream_m9305:-:*:*:*:*:*:*:* | not specified by NVD | Running on | VITEC |
| cpe:2.3:o:vitec:avediastream_r9300_firmware:*:*:*:*:*:*:*:* | up to 2021-04-30 | Vulnerable | VITEC |
| cpe:2.3:h:vitec:avediastream_r9300:-:*:*:*:*:*:*:* | not specified by NVD | Running on | VITEC |
| cpe:2.3:o:vitec:avediastream_r9310_firmware:*:*:*:*:*:*:*:* | up to 2021-04-30 | Vulnerable | VITEC |
| cpe:2.3:h:vitec:avediastream_r9310:-:*:*:*:*:*:*:* | not specified by NVD | Running on | VITEC |
| cpe:2.3:o:vitec:avediastream_m9325_firmware:*:*:*:*:*:*:*:* | up to 2021-04-30 | Vulnerable | VITEC |
| cpe:2.3:h:vitec:avediastream_m9325:-:*:*:*:*:*:*:* | not specified by NVD | Running on | VITEC |
| cpe:2.3:o:vitec:avediastream_r9350_firmware:*:*:*:*:*:*:*:* | up to 2021-04-30 | Vulnerable | VITEC |
| cpe:2.3:h:vitec:avediastream_r9350:-:*:*:*:*:*:*:* | not specified by NVD | Running on | VITEC |
- cpe:2.3:h:vitec:avediastream_m9305:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·VITEC
- cpe:2.3:o:vitec:avediastream_r9300_firmware:*:*:*:*:*:*:*:* Versions up to 2021-04-30 Vulnerable ·VITEC
- cpe:2.3:h:vitec:avediastream_r9300:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·VITEC
- cpe:2.3:o:vitec:avediastream_r9310_firmware:*:*:*:*:*:*:*:* Versions up to 2021-04-30 Vulnerable ·VITEC
- cpe:2.3:h:vitec:avediastream_r9310:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·VITEC
- cpe:2.3:o:vitec:avediastream_m9325_firmware:*:*:*:*:*:*:*:* Versions up to 2021-04-30 Vulnerable ·VITEC
- cpe:2.3:h:vitec:avediastream_m9325:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·VITEC
- cpe:2.3:o:vitec:avediastream_r9350_firmware:*:*:*:*:*:*:*:* Versions up to 2021-04-30 Vulnerable ·VITEC
- cpe:2.3:h:vitec:avediastream_r9350:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·VITEC
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2021-42109
- 2026-10-03 Alias added: GHSA-24gx-p8r7-xrqm
References
Sources
- CVE-2021-42109 · CVE Program
- CVE-2021-42109 · NVD
- FIRST EPSS
- GHSA-24gx-p8r7-xrqm · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences