CVE-2021-47827
Published: 16 January 2026
Summary
CVE-2021-47827 is a medium-severity Improper Validation of Specified Quantity in Input (CWE-1284) vulnerability in Apple (inferred from references). Its CVSS base score is 4.6 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 9.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2021-47827 is a denial of service vulnerability in the mashREPL tool of WebSSH for iOS version 14.16.10. The issue allows attackers to crash the application by pasting malformed input, such as a 300-character buffer of repeated 'A' characters into the mashREPL input field. It carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and maps to CWE-1284.
The vulnerability can be exploited by any network-accessible attacker requiring low complexity, no privileges, and no user interaction. Exploitation crashes the WebSSH iOS application, resulting in a denial of service with high availability impact but no confidentiality or integrity effects.
Advisories and related resources include the WebSSH app page on the Apple App Store, an exploit proof-of-concept published on Exploit-DB (ID 49883), and a VulnCheck advisory detailing the WebSSH for iOS mashREPL denial of service. No specific patch or mitigation details are outlined in the provided references.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-2899
Vulnerability details
WebSSH for iOS 14.16.10 contains a denial of service vulnerability in the mashREPL tool that allows attackers to crash the application by pasting malformed input. Attackers can trigger the vulnerability by copying a 300-character buffer of repeated 'A' characters into…
more
the mashREPL input field, causing the application to crash.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Malformed input triggers application crash via unvalidated buffer, directly enabling Endpoint DoS through software exploitation (T1499.004).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires validation of all inputs to the mashREPL tool, directly preventing crashes from malformed pasted data such as 300-character buffers of repeated characters.
Implements safeguards against denial-of-service events like application crashes triggered by oversized or malformed network inputs to the REPL tool.
Ensures error handling for malformed inputs in the mashREPL tool does not result in application crashes, maintaining availability.