CVE-2021-47849
BaseFortify
Publication date: 2026-01-21
Last updated on: 2026-02-02
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| yodinfo | mini_mouse | 9.3.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-22 | The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2021-47849 is a Local File Inclusion (LFI) and path traversal vulnerability in Mini Mouse version 9.3.0. It allows attackers to manipulate file path parameters in API requests to access and retrieve file listings and contents from sensitive system directories such as /usr, /etc, and /var. This happens because the application does not properly sanitize input paths, enabling attackers to bypass restrictions and read arbitrary files on the device, including system and user data outside the app's sandbox. [1, 3]
How can this vulnerability impact me? :
This vulnerability can lead to unauthorized disclosure of sensitive system and user files on devices running the vulnerable Mini Mouse app. Attackers can access critical system directories and files, such as /etc/passwd, which may reveal user accounts and system configuration. This information disclosure can facilitate further attacks by exposing confidential data and system details, compromising the confidentiality of the device. [1, 3]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by sending crafted HTTP requests to the Mini Mouse app's local server interface, which listens on port 8039. For example, you can send a GET request to `/op=get_device_info` to retrieve device information, or a POST request to `/op=get_file_list` with a JSON payload specifying directory paths like `/usr`, `/etc`, or `/var` to check if file listings are returned. Additionally, sending a GET request to `/file=` with a path parameter (e.g., `/etc/passwd`) can test if arbitrary files can be read. These requests can be performed using tools like curl or any HTTP client. Example commands: 1. `curl -X GET http://<device_ip>:8039/op=get_device_info` 2. `curl -X POST http://<device_ip>:8039/op=get_file_list -H 'Content-Type: application/json' -d '{"path":"/etc"}'` 3. `curl -X GET http://<device_ip>:8039/file=/etc/passwd` If these requests return sensitive file information or directory listings, the vulnerability is present. [1, 3]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include disabling or restricting access to the Mini Mouse app's local server interface on port 8039 to prevent unauthorized API requests. Ensure that the app is updated to a version where this vulnerability is patched, if available. If an update is not available, restrict network access to the device running the app, especially from untrusted networks. Additionally, monitor network traffic for suspicious requests targeting the vulnerable endpoints and consider implementing firewall rules to block such traffic. [1, 3]