{"uuid": "52f9f58c-bacd-41ab-922f-00284e732059", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-28797", "type": "published-proof-of-concept", "source": "https://t.me/cissp/2945", "content": "CVE-2021-29627:\nIn FreeBSD 13.0-STABLE < n245050, 12.2-STABLE < r369525, 13.0-RC4 < p0, 12.2-RELEASE < p6, listening socket accept filters implementing the accf_create callback incorrectly freed a process supplied argument string. Additional operations on the socket can lead to a double free/use after free (1-day PoC)\nhttps://github.com/raymontag/cve-2021-29627\n\nRed Team Tactics:\n1. Unauthenticated Account Takeover Through Forget Password\nhttps://infosecwriteups.com/unauthenticated-account-takeover-through-forget-password-c120b4c1141d\n2. A webshell that can bypass some system security\nhttps://github.com/22XploiterCrew-Team/Gel4y-Mini-Shell-Backdoor\n\nThreat Research:\nMemory corruption vulnerability in QNAP QTS\u2019s Surveillance Station plugin leads to a pre-auth RCE\n(PoC for CVE-2021-28797)\nhttps://ssd-disclosure.com/ssd-advisory-qnap-pre-auth-cgi_find_parameter-rce", "creation_timestamp": "2026-09-12T00:00:43.113998Z"}