CVE-2021-37376

Public exploit available. Not confirmed exploited in the wild yet. A vendor fix is available.

CVSS 3.15.4Medium EPSS percentile49th0.6% chance in 30 days CISA KEVNot listedNo confirmed exploitation
Public exploit: 1 source FixVendor fixNo build named by the sources

Published 2023-02-03Updated 2024-11-21Sources: CVE.org, NVD

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Teradek Bond FirmwareAffected: ≥ 7.3.0, ≤ 7.3.18Upgrade to: after 7.3.18Stated by: NVD
Teradek Bond 2 FirmwareAffected: ≥ 7.3.0, ≤ 7.3.19Upgrade to: after 7.3.19Stated by: NVD
Teradek Bond Pro FirmwareAffected: ≥ 7.3.0, ≤ 7.3.19Upgrade to: after 7.3.19Stated by: NVD

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check whether you run Teradek Bond firmware 7.3.x or earlier and identify who can access its management page.
Limit the management page to trusted staff and private networks; remove unnecessary user accounts and do not expose it directly to the internet.
There is no fixed firmware version: the product is end of life and the vendor will not provide an update, so plan replacement with supported equipment.

Vendor advisory Some work to apply

Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Cross Site Scripting (XSS) vulnerability in Teradek Bond, Bond 2 and Bond Pro firmware version 7.3.x and earlier allows remote attackers to run arbitrary code via the Friendly Name field in System Information Settings. NOTE: Vedor states the product has reached End of Life and will not be receiving any firmware updates to address this issue.

In plain language

Written by AI from the record

Teradek Bond firmware 7.3.x and earlier has a flaw that can let a logged-in user trick another user’s browser, so affected small businesses should restrict access and plan to replace the device.

Stored XSS in the System Information Friendly Name field allows a low-privileged authenticated attacker to execute script in another user’s browser when the crafted value is viewed.

If you're affected

Administrator session theft
Device setting changes
Live video workflow disruption
Unauthorized dashboard actions

What is it

This flaw lets someone with a device account save a booby-trapped name in the device’s settings. When another person later opens that settings page, the trap can act in their browser like a forged instruction slipped into an office clipboard.

Who is affected

This matters to you if you use or manage Teradek Bond firmware for video connectivity. An attacker needs a login and must get another user to view the affected settings page.

How urgent is it

A public exploit is available, so treat this as a prompt containment and replacement issue. It is not listed by CISA as known to be actively exploited, but there is no vendor update to reduce the risk on affected devices.

What to do — in detail

Confirm the installed firmware version and review all accounts that can access the device’s web management interface. Affected releases are 7.3.x and earlier; there are no fixed branches or upgrade targets because Teradek states the product is end of life and will not receive firmware updates.

Until replacement, place the management interface on a private management network, restrict it to named administrators, remove unused accounts, and avoid opening System Information settings from untrusted or unexpected workflows. Review web-interface access records and administrator account activity for unfamiliar logins or unexpected changes to the Friendly Name field. No CISA KEV remediation due date applies.

Technical context

CVE-2021-37376 is CWE-79 stored cross-site scripting in the Friendly Name field under System Information Settings. CVSS v3.1 is 5.4 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N): exploitation requires low privileges and user interaction, with network access. A public exploit is available; CISA KEV does not list this CVE. EPSS is 0.6% (48th percentile) with a flat trend.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS49th

Public exploit

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

1 source with a proof of concept or module.

Exploit links, PoCs and Metasploit modules after sign-in

EPSS

0.6% chance of exploitation activity in the next 30 days, which ranks it in the 49th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

The patch came 471 days before any public exploit.

2026-03-06Public exploit / PoCsource: other
2024-11-21Patch availablerecord updated
2023-02-03Publishedweakness classified, att&ck mapped

Affected products

teradekcommercial

And 1 more affected product. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Scored 5.4 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required LowRequires basic user-level privileges
User Interaction RequiredA user must click a link, open a file, or perform some action

Scope

Scope ChangedThe exploit can affect other components (e.g. sandbox escape, host compromise from VM)

Impact if exploited

Confidentiality LowSome restricted information is disclosed, but limited in scope
Integrity LowData modification is possible but limited in scope or consequence
Availability NoneNo availability impact