CVE-2021-4481

Dräger Protector Software prior to version 6.4.2 contains a local privilege escalation vulnerability due to insecure file system permissions that allows local attackers to execute arbitrary code with elevated privileges. Attackers can replace binaries or loaded modules on the host system to execute code with NT SYSTEM privileges.

CVSS v3 8.2 HIGH

8.2^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.8

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://static.draeger.com/security/download/2021-267-01-Draeger-Protector-Software-vulnerabilities.pdf
https://www.vulncheck.com/advisories/dr-ger-protector-software-local-privilege-escalation-via-insecure-file-permissions

Configurations

No configuration.

History

22 Jul 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) El software Dräger Protector anterior a la versión 6.4.2 contiene una vulnerabilidad de escalada de privilegios local debido a permisos de sistema de archivos inseguros que permite a atacantes locales ejecutar código arbitrario con privilegios elevados. Los atacantes pueden reemplazar binarios o módulos cargados en el sistema anfitrión para ejecutar código con privilegios de NT SYSTEM.

03 Jun 2026, 23:16

Type	Values Removed	Values Added
References	~~{'url': 'https://static.draeger.com/security/download/PSA-21-347-1-SCG-Security-Advisory.pdf', 'source': 'disclosure@vulncheck.com'}~~	() https://static.draeger.com/security/download/2021-267-01-Draeger-Protector-Software-vulnerabilities.pdf -

03 Jun 2026, 20:16

Type	Values Removed	Values Added
References	~~{'url': 'https://static.draeger.com/security', 'source': 'disclosure@vulncheck.com'}~~	() https://static.draeger.com/security/download/PSA-21-347-1-SCG-Security-Advisory.pdf -

02 Jun 2026, 22:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-06-02 22:16

Updated : 2026-07-22 19:10

NVD link : CVE-2021-4481

Mitre link : CVE-2021-4481

CVE.ORG link : CVE-2021-4481

JSON object : View

Products Affected

No product.

CWE

CWE-732

Incorrect Permission Assignment for Critical Resource

{"id": "CVE-2021-4481", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2021-4481", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-03T19:17:03.282571Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 5.8, "exploitabilityScore": 1.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.3, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "Dr\u00e4ger", "product": "Protector Software", "versions": [{"status": "affected", "version": "0", "lessThan": "6.4.2", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2026-06-02T22:16:15.503", "references": [{"url": "https://static.draeger.com/security/download/2021-267-01-Draeger-Protector-Software-vulnerabilities.pdf", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/dr-ger-protector-software-local-privilege-escalation-via-insecure-file-permissions", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-732"}]}], "descriptions": [{"lang": "en", "value": "Dr\u00e4ger Protector Software prior to version 6.4.2 contains a local privilege escalation vulnerability due to insecure file system permissions that allows local attackers to execute arbitrary code with elevated privileges. Attackers can replace binaries or loaded modules on the host system to execute code with NT SYSTEM privileges."}, {"lang": "es", "value": "El software Dr\u00e4ger Protector anterior a la versi\u00f3n 6.4.2 contiene una vulnerabilidad de escalada de privilegios local debido a permisos de sistema de archivos inseguros que permite a atacantes locales ejecutar c\u00f3digo arbitrario con privilegios elevados. Los atacantes pueden reemplazar binarios o m\u00f3dulos cargados en el sistema anfitri\u00f3n para ejecutar c\u00f3digo con privilegios de NT SYSTEM."}], "lastModified": "2026-07-22T19:10:00.120", "sourceIdentifier": "disclosure@vulncheck.com"}