{"vulnerability": "CVE-2021-3297", "sightings": [{"uuid": "989763ca-04fb-43fb-9257-a108d7c5a31c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3297", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-09-16)", "content": "", "creation_timestamp": "2025-09-16T00:00:00.000000Z"}, {"uuid": "542f434d-62a7-4739-80dc-fb2bc9681bce", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3297", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-09-22)", "content": "", "creation_timestamp": "2025-09-22T00:00:00.000000Z"}, {"uuid": "5556a804-4237-4463-b2e9-9b1617afdee7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3297", "type": "seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3lwwto2rjae25", "content": "", "creation_timestamp": "2025-08-21T21:02:33.186033Z"}, {"uuid": "ffdf30d3-db2d-41aa-8afe-5bdaab747b19", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3297", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-10-14)", "content": "", "creation_timestamp": "2025-10-14T00:00:00.000000Z"}, {"uuid": "fa6d0e3d-96c5-45f7-afbc-79efd011df78", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3297", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-09-29)", "content": "", "creation_timestamp": "2025-09-29T00:00:00.000000Z"}, {"uuid": "ac12050a-42e6-4f2d-b9ef-a2f384948faf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3297", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-11-29)", "content": "", "creation_timestamp": "2025-11-29T00:00:00.000000Z"}, {"uuid": "4d75c032-17d2-4d1e-9f8e-fea85139267f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3297", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-03-25)", "content": "", "creation_timestamp": "2026-03-25T00:00:00.000000Z"}, {"uuid": "bf642347-d28b-4332-98f2-89b8a59458d4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3297", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-01-25)", "content": "", "creation_timestamp": "2026-01-25T00:00:00.000000Z"}, {"uuid": "dd1cf404-1d38-413a-b6ec-044d677de268", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3297", "type": "published-proof-of-concept", "source": "https://t.me/pwnwiki_zhchannel/77", "content": "CVE-2021-3297 Zyxel NBG2105 \u8eab\u4efd\u9a57\u8b49\u7e5e\u904e\u6f0f\u6d1e\nhttps://www.pwnwiki.org/index.php?title=CVE-2021-3297_Zyxel_NBG2105_%E8%BA%AB%E4%BB%BD%E9%A9%97%E8%AD%89%E7%B9%9E%E9%81%8E%E6%BC%8F%E6%B4%9E", "creation_timestamp": "2021-09-21T06:42:52.000000Z"}, {"uuid": "838f845e-f2cd-4289-8498-36a0f8132392", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-32970", "type": "seen", "source": "https://t.me/cibsecurity/40048", "content": "\u203c CVE-2021-32970 \u203c\n\nData can be copied without validation in the built-in web server in Moxa NPort IAW5000A-I/O series firmware version 2.2 or earlier, which may allow a remote attacker to cause denial-of-service conditions.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-04-02T02:26:06.000000Z"}, {"uuid": "d0a295f3-dafc-4288-81b8-0b6dd920a66e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-32978", "type": "seen", "source": "https://t.me/cibsecurity/40130", "content": "\u203c CVE-2021-32978 \u203c\n\nThe programming protocol allows for a previously entered password and lock state to be read by an attacker. If the previously entered password was successful, the attacker can then use the password to unlock Automation Direct CLICK PLC CPU Modules: C0-1x CPUs with firmware prior to v3.00.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-04-05T00:28:10.000000Z"}, {"uuid": "6f5d4741-152f-40fb-b681-d956207a9d92", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-32976", "type": "seen", "source": "https://t.me/cibsecurity/40064", "content": "\u203c CVE-2021-32976 \u203c\n\nFive buffer overflows in the built-in web server in Moxa NPort IAW5000A-I/O series firmware version 2.2 or earlier may allow a remote attacker to initiate a denial-of-service attack and execute arbitrary code.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-04-02T02:26:30.000000Z"}, {"uuid": "9ca6743b-b23f-4e89-8174-9485511aa044", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-32974", "type": "seen", "source": "https://t.me/cibsecurity/40063", "content": "\u203c CVE-2021-32974 \u203c\n\nImproper input validation in the built-in web server in Moxa NPort IAW5000A-I/O series firmware version 2.2 or earlier may allow a remote attacker to execute commands.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-04-02T02:26:29.000000Z"}, {"uuid": "b92c1f33-0e61-44bd-919b-21248b3e72b6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-32975", "type": "seen", "source": "https://t.me/cibsecurity/27888", "content": "\u203c CVE-2021-32975 \u203c\n\nCscape (All Versions prior to 9.90 SP5) lacks proper validation of user-supplied data when parsing project files. This could lead to an out-of-bounds read. An attacker could leverage this vulnerability to execute code in the context of the current process.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-08-25T22:26:10.000000Z"}, {"uuid": "66dcbdc0-a2fa-4865-a2eb-531bc797607b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-32971", "type": "seen", "source": "https://t.me/cibsecurity/29317", "content": "\u203c CVE-2021-32971 \u203c\n\nNull pointer dereference in SuiteLink server while processing command 0x07\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-09-23T18:29:36.000000Z"}, {"uuid": "1c7424f4-f4cb-4ea4-a2f1-8ab2a16827cc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-32979", "type": "seen", "source": "https://t.me/cibsecurity/29309", "content": "\u203c CVE-2021-32979 \u203c\n\nNull pointer dereference in SuiteLink server while processing commands 0x04/0x0a\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-09-23T18:29:28.000000Z"}, {"uuid": "901c2e10-d884-4ac2-84d3-fe35de4484a8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3297", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/3099", "content": "#WLAN_Security\nCVE-2021-3297:\nOn Zyxel NBG2105 V1.00(AAGU.2)C0 devices, setting the login cookie to 1 provides administrator access (PoC)\nhttps://github.com/Sec504/Zyxel-NBG2105-CVE-2021-3297", "creation_timestamp": "2021-04-11T13:02:03.000000Z"}, {"uuid": "c00100f2-9c5e-4f71-87ee-179e8496b4df", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3297", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-06-07)", "content": "", "creation_timestamp": "2026-06-07T00:00:00.000000Z"}, {"uuid": "346e0e52-d8c8-4970-bc0a-ca5bcef0d817", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3297", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/44d155df-0b07-41ce-819d-020ea5b8ff0d", "content": "", "creation_timestamp": "2026-06-19T12:45:53.886256Z"}, {"uuid": "6de29237-2aac-484f-b386-1841a5b59089", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3297", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/91601d2e-6106-4268-b3d2-810ad7ba570f", "content": "", "creation_timestamp": "2026-06-23T14:03:18.444501Z"}, {"uuid": "d2515566-a815-4fb1-b258-61e9444de138", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3297", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-06-25)", "content": "", "creation_timestamp": "2026-06-26T10:15:13.586734Z"}, {"uuid": "50d5741e-df0d-436b-b8f7-46ffeec75e62", "vulnerability_lookup_origin": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "author": "af0120d0-3dac-4a6a-974b-a9f33d2a9846", "vulnerability": "CVE-2021-3297", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/f4ab4dd9-4529-46b1-8046-8dc0d861b2ab", "content": "", "creation_timestamp": "2026-06-30T09:22:48.588685Z"}, {"uuid": "828c3bfc-571b-4d5f-b89e-53701f9dcee3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3297", "type": "seen", "source": "https://t.me/cissp/2933", "content": "exploit\nCVE-2021-25374:\nAn improper authorization vulnerability in Samsung Members \"samsungrewards\" scheme for deeplink in versions 2.4.83.9 in Android <=8.1, 3.9.00.9 in Android <=9.0 allows remote attackers to access a user data related with Samsung Account\n]-> Samsung Account Access Script (1-day PoC):\nhttps://github.com/FSecureLABS/CVE-2021-25374_Samsung-Account-Access\n\nMalware analysis\nA deep dive into Saint Bot, a new downloader\ud83d\ude0a\nhttps://blog.malwarebytes.com/threat-analysis/2021/04/a-deep-dive-into-saint-bot-downloader\n\nWLANSecurity\nCVE-2021-3297:\nOn Zyxel NBG2105 V1.00(AAGU.2)C0 devices, setting the login cookie to 1 provides administrator access (PoC)\nhttps://github.com/Sec504/Zyxel-NBG2105-CVE-2021-3297\n\nThreat Research:\nGamifying machine learning for stronger security and AI models\ud83e\uddd0\nhttps://www.microsoft.com/security/blog/2021/04/08/gamifying-machine-learning-for-stronger-security-and-ai-models", "creation_timestamp": "2026-09-01T17:00:55.099229Z"}, {"uuid": "3ad9b903-c73d-4660-ab59-59555a616c74", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3297", "type": "published-proof-of-concept", "source": "https://t.me/cissp/2933", "content": "exploit\nCVE-2021-25374:\nAn improper authorization vulnerability in Samsung Members \"samsungrewards\" scheme for deeplink in versions 2.4.83.9 in Android <=8.1, 3.9.00.9 in Android <=9.0 allows remote attackers to access a user data related with Samsung Account\n]-> Samsung Account Access Script (1-day PoC):\nhttps://github.com/FSecureLABS/CVE-2021-25374_Samsung-Account-Access\n\nMalware analysis\nA deep dive into Saint Bot, a new downloader\ud83d\ude0a\nhttps://blog.malwarebytes.com/threat-analysis/2021/04/a-deep-dive-into-saint-bot-downloader\n\nWLANSecurity\nCVE-2021-3297:\nOn Zyxel NBG2105 V1.00(AAGU.2)C0 devices, setting the login cookie to 1 provides administrator access (PoC)\nhttps://github.com/Sec504/Zyxel-NBG2105-CVE-2021-3297\n\nThreat Research:\nGamifying machine learning for stronger security and AI models\ud83e\uddd0\nhttps://www.microsoft.com/security/blog/2021/04/08/gamifying-machine-learning-for-stronger-security-and-ai-models", "creation_timestamp": "2026-09-11T10:00:05.234384Z"}]}