CVE-2021-46704 — AI Deep Analysis Summary

Q: Who is affected? (Versions/Components)

📦 **Affected**: **GenieACS** versions **< 1.2.8** (specifically >= 1.2.0). 🌐 **Component**: The UI interface API endpoint handling the `ping` host argument.

Q: Is exploitation threshold high? (Auth/Config)

⚡ **Threshold**: **LOW**. 🚫 **Auth**: **Unauthenticated**. No login or API key is required to trigger the vulnerability via the `ping` parameter. This makes it extremely dangerous.

Q: Is there a public Exp? (PoC/Wild Exploitation)

🔓 **Public Exp**: **YES**. Multiple PoCs are available on GitHub (e.g., `MithatGuner/CVE-2021-46704-POC`) and Nuclei templates exist for automated scanning. Wild exploitation is highly probable.

Q: Is it fixed officially? (Patch/Mitigation)

✅ **Official Fix**: **YES**. Upgrade GenieACS to version **1.2.8** or higher. 📝 **Commit**: Fixed in commit `7f295beeecc1c1f14308a93c82413bb334045af6`.

Q: Is it urgent? (Priority Suggestion)

🔥 **Urgency**: **CRITICAL**. 🚨 Since it is **unauthenticated** and allows **RCE**, it is a high-priority target for automated bots. Immediate patching or network isolation is required.

Updated May 08, 2026

This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login. Read the full analysis →

Q1What is this vulnerability? (Essence + Consequences)

🚨 **Essence**: GenieACS suffers from **Unauthenticated OS Command Injection**.…

Read full answer (login)

Q2Root Cause? (CWE/Flaw)

🛡️ **Root Cause**: **Insufficient Input Validation** combined with a **Missing Authorization Check**.…

Read full answer (login)

Q3Who is affected? (Versions/Components)

📦 **Affected**: **GenieACS** versions **< 1.2.8** (specifically >= 1.2.0). 🌐 **Component**: The UI interface API endpoint handling the `ping` host argument.

Q4What can hackers do? (Privileges/Data)

💀 **Attacker Capabilities**: Full **OS Command Execution** on the host server.…

Read full answer (login)

Q5Is exploitation threshold high? (Auth/Config)

⚡ **Threshold**: **LOW**. 🚫 **Auth**: **Unauthenticated**. No login or API key is required to trigger the vulnerability via the `ping` parameter. This makes it extremely dangerous.

Q6Is there a public Exp? (PoC/Wild Exploitation)

🔓 **Public Exp**: **YES**. Multiple PoCs are available on GitHub (e.g., `MithatGuner/CVE-2021-46704-POC`) and Nuclei templates exist for automated scanning. Wild exploitation is highly probable.

Q7How to self-check? (Features/Scanning)

🔍 **Self-Check**: Use **Nuclei** with the CVE-2021-46704 template.…

Read full answer (login)

Q8Is it fixed officially? (Patch/Mitigation)

✅ **Official Fix**: **YES**. Upgrade GenieACS to version **1.2.8** or higher. 📝 **Commit**: Fixed in commit `7f295beeecc1c1f14308a93c82413bb334045af6`.

Q9What if no patch? (Workaround)

🚧 **Workaround**: If patching is impossible, **block external access** to the GenieACS UI/API port.…

Read full answer (login)

Q10Is it urgent? (Priority Suggestion)

🔥 **Urgency**: **CRITICAL**. 🚨 Since it is **unauthenticated** and allows **RCE**, it is a high-priority target for automated bots. Immediate patching or network isolation is required.

Continue exploring

Vulnerability detail Full AI analysis (login) n/a