Vulnerabilities

CVSS

8.8 High

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Risk score

70.4

Published

2024-07-04

Status

Modified

rejetto HFS (aka HTTP File Server) 3 before 0.52.10 on Linux, UNIX, and macOS allows OS command execution by remote authenticated users (if they have Upload permissions). This occurs because a shell is used to execute df (i.e., with execSync instead of spawnSync in child_process in Node.js).

Weaknesses

CWE-78CWE-284

Coverage 1

threat-intel

Hackers Compromised 14,500+ Dahua Devices Using Credential Attacks, Auth Bypasses, and P2P

Researchers at Hunt.io have uncovered a campaign targeting over 14,500 Dahua IP cameras, leveraging credential attacks and two authentication bypass vulnerabilities (CVE-2021-33044 and CVE-2021-33045) to gain unauthorize…

The Hacker News · Aug 19, 2026 High

CVE-2021-33044CVE-2021-33045CVE-2024-39943UKRUcredential attackauthentication bypassp2p

All articles mentioning it

Advisories and references

• github.com/rejetto/hfs/commit/305381bd36eee074fb238b64302a252668daad...
• github.com/rejetto/hfs/compare/v0.52.9...v0.52.10
• rejetto.com/wiki/index.php/HFS:_Working_with_uploads
• github.com/rejetto/hfs/commit/305381bd36eee074fb238b64302a252668daad...
• github.com/rejetto/hfs/compare/v0.52.9...v0.52.10
• rejetto.com/wiki/index.php/HFS:_Working_with_uploads