CVE-2021-41033
Published: 13 September 2021
Summary
CVE-2021-41033 is a high-severity Channel Accessible by Non-Endpoint (CWE-300) vulnerability in Eclipse Equinox. Its CVSS base score is 8.1 (High).
Operationally, ranked in the top 44.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2021-28186
Vulnerability details
In all released versions of Eclipse Equinox, at least until version 4.21 (September 2021), installation can be vulnerable to man-in-the-middle attack if using p2 repos that are HTTP; that can then be exploited to serve incorrect p2 metadata and entirely…
more
alter the local installation, particularly by installing plug-ins that may then run malicious code.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Ensures only authenticated endpoints can access the communication channel, blocking unauthorized non-endpoint access.
Physically restricts transmission channels so they cannot be accessed or tapped by non-endpoint actors within facilities.
Periodic TSCM surveys identify unauthorized access points or taps that make communication channels reachable by non-endpoint adversaries.
Explicitly isolates the communications path so it cannot be accessed or intercepted by non-endpoint entities during security functions.
Restrictions and channel controls reduce the chance that VoIP media or signaling streams remain accessible to non-participants.
Directly prevents non-endpoint access or interception of the session communication path.
An out-of-band channel is inaccessible to non-endpoints that can observe or interfere with the primary communication channel.
The control restricts an inherently broadcast wireless channel to only intended endpoints, mitigating accessibility by non-endpoints.