{"uuid": "684bb788-6c04-49b1-9090-b160f4452906", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-28797", "type": "seen", "source": "https://t.me/cissp/2945", "content": "CVE-2021-29627:\nIn FreeBSD 13.0-STABLE < n245050, 12.2-STABLE < r369525, 13.0-RC4 < p0, 12.2-RELEASE < p6, listening socket accept filters implementing the accf_create callback incorrectly freed a process supplied argument string. Additional operations on the socket can lead to a double free/use after free (1-day PoC)\nhttps://github.com/raymontag/cve-2021-29627\n\nRed Team Tactics:\n1. Unauthenticated Account Takeover Through Forget Password\nhttps://infosecwriteups.com/unauthenticated-account-takeover-through-forget-password-c120b4c1141d\n2. A webshell that can bypass some system security\nhttps://github.com/22XploiterCrew-Team/Gel4y-Mini-Shell-Backdoor\n\nThreat Research:\nMemory corruption vulnerability in QNAP QTS\u2019s Surveillance Station plugin leads to a pre-auth RCE\n(PoC for CVE-2021-28797)\nhttps://ssd-disclosure.com/ssd-advisory-qnap-pre-auth-cgi_find_parameter-rce", "creation_timestamp": "2026-09-01T17:00:55.227844Z"}