BaseFortify

Publication date: 2025-11-14

Last updated on: 2025-11-17

Assigner: VulnCheck

Description

TG8 Firewall exposes a directory such as /data/ over HTTP without authentication. This directory stores credential files for previously logged-in users. A remote unauthenticated attacker can enumerate and download files within the directory to obtain valid account usernames and passwords, leading to loss of confidentiality and further unauthorized access.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-11-14

Last Modified

2025-11-17

Generated

2026-07-07

AI Q&A

2025-11-15

EPSS Evaluated

2026-07-05

NVD

CVE-2021-4471

Affected Vendors & Products

Vendor	Product	Version / Range
tg8	firewall	4.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-538	The product places sensitive information into files or directories that are accessible to actors who are allowed to have access to the files, but not to the sensitive information.

Attack-Flow Graph

Executive Summary

This vulnerability involves the TG8 Firewall exposing a directory such as /data/ over HTTP without requiring authentication. This directory contains credential files for users who have previously logged in. Because it is accessible without authentication, a remote attacker can enumerate and download these files to obtain valid usernames and passwords.

Impact Analysis

An attacker exploiting this vulnerability can gain access to valid account usernames and passwords, leading to loss of confidentiality and potentially further unauthorized access to the system or network protected by the TG8 Firewall.

Hi! I’m here to help you understand CVE-2021-4471. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70