Is CVE-2021-43175 actively exploited?

No active exploitation of CVE-2021-43175 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2021-43175 be exploited remotely?

Yes. CVE-2021-43175 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2021-43175?

CVE-2021-43175 has a CVSS score of 7.5 (HIGH).

HOME VULNERABILITIESCVE-2021-43175

HIGH

CVE-2021-43175

CWE-305Published: December 7, 2021· Updated: Jun 17, 2026

7.5

CVSS v3.1

Official Description

The GOautodial API prior to commit 3c3a979 made on October 13th, 2021 exposes an API router that accepts a username, password, and action that routes to other PHP files that implement the various API functions. Vulnerable versions of GOautodial validate the username and password incorrectly, allowing the caller to specify any values for these parameters and successfully authenticate. CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C

NVD Source

Technical Analysis

CVE-2021-43175 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in complete confidentiality breach (data exposure), with a CVSS base score of 7.5.