{"id":"CVE-2021-47794","state":"PUBLISHED","title":"ZesleCP 3.1.9 - Remote Code Execution (RCE) (Authenticated)","description":"ZesleCP 3.1.9 contains an authenticated remote code execution vulnerability that allows attackers to create malicious FTP accounts with shell injection payloads. Attackers can exploit the FTP account creation endpoint by injecting a reverse shell command that establishes a network connection to a specified listening host.","publishedAt":"2026-01-15T23:25:43.586Z","updatedAt":"2026-03-05T01:28:36.743Z","severity":{"score":8.7,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","source":"VulnCheck"},"assigner":"VulnCheck","products":["Zeslecp ZesleCP"],"affected":[{"vendor":"Zeslecp","product":"ZesleCP","versions":[{"version":"<=3.1.9","status":"affected"}]}],"references":["https://www.exploit-db.com/exploits/50233","https://zeslecp.com/","https://www.youtube.com/watch?v=5lTDTEBVq-0","https://www.vulncheck.com/advisories/zeslecp-remote-code-execution-rce-authenticated"],"weaknesses":["CWE-78"],"ingestedAt":"2026-10-29T19:49:19.404Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2021/47xxx/CVE-2021-47794.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2021-47794","state":"PUBLISHED","datePublished":"2026-01-15T23:25:43.586Z","dateUpdated":"2026-03-05T01:28:36.743Z","assignerShortName":"VulnCheck","assignerOrgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateReserved":"2026-01-14T14:39:44.739Z"},"containers":{"cna":{"title":"ZesleCP 3.1.9 - Remote Code Execution (RCE) (Authenticated)","descriptions":[{"lang":"en","value":"ZesleCP 3.1.9 contains an authenticated remote code execution vulnerability that allows attackers to create malicious FTP accounts with shell injection payloads. Attackers can exploit the FTP account creation endpoint by injecting a reverse shell command that establishes a network connection to a specified listening host."}],"affected":[{"vendor":"Zeslecp","product":"ZesleCP","versions":[{"version":"<=3.1.9","status":"affected"}]}],"references":[{"url":"https://www.exploit-db.com/exploits/50233","name":"ExploitDB-50233","tags":["exploit"]},{"url":"https://zeslecp.com/","name":"ZesleCP Official Website","tags":["product"]},{"url":"https://www.youtube.com/watch?v=5lTDTEBVq-0","name":"Exploit Demonstration Video","tags":["exploit"]},{"url":"https://www.vulncheck.com/advisories/zeslecp-remote-code-execution-rce-authenticated","name":"VulnCheck Advisory: ZesleCP 3.1.9 - Remote Code Execution (RCE) (Authenticated)","tags":["third-party-advisory"]}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":8.7,"baseSeverity":"HIGH","exploitMaturity":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS"},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-78","lang":"en","description":"Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","type":"CWE"}]}],"providerMetadata":{"shortName":"VulnCheck","orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateUpdated":"2026-03-05T01:28:36.743Z"},"datePublic":"2021-08-27T00:00:00.000Z","cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:zesle:zeslecp:3.1.9:*:*:*:*:*:*:*"}]}]}],"credits":[{"lang":"en","value":"Numan Türle","type":"finder"}],"x_generator":{"engine":"vulncheck"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-01-16T16:08:39.174456Z","id":"CVE-2021-47794","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-01-16T16:08:49.792Z"}}]}}}