[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fJfSXp_PP5etp5S-ZVCtqZwYdAYq9OeTRlCyyqR5V4iI":3,"g5a-risk:CVE-2021-42835":136},{"success":4,"data":5,"meta":134},true,{"cveId":6,"title":7,"description":8,"shortDescription":9,"publishedDate":10,"lastModified":11,"cvssScore":12,"cvssVector":13,"cvssMetrics":14,"epssScore":39,"epssPercentile":26,"epssTimeSeries":40,"severity":41,"affectedProducts":42,"affectedProductsCount":53,"references":54,"referencesCount":74,"weaknesses":75,"weaknessesCount":27,"isActivelyExploited":84,"cisaInfo":26,"otxData":26,"relatedBlogPosts":85,"seoMetadata":86,"configurations":111,"relatedVendorCves":125,"notableEvents":126},"CVE-2021-42835","What is CVE-2021-42835?","An issue was discovered in Plex Media Server through 1.24.4.5081-e362dc1ee. An attacker (with a foothold in a endpoint via a low-privileged user account) can access the exposed RPC service of the update service component. This RPC functionality allows the attacker to interact with the RPC functionality and execute code from a path of his choice (local, or remote via SMB) because of a TOCTOU race condition. This code execution is in the context of the Plex update service (which runs as SYSTEM).","An issue was discovered in Plex Media Server through 1.24.4.5081-e362dc1ee. An attacker (with a foothold in a endpoint via a low-privileged user account) can...","2021-12-08T15:15:10.18","2021-12-13T17:14:44.227",7,"CVSS:3.1\u002FAV:L\u002FAC:H\u002FPR:L\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H",{"CVSSMetricV31":15,"CVSSMetricV30":26,"CVSSMetricV2":29,"CVSSMetricV40":26},[16],{"Source":17,"Type":18,"CVSSData":19,"ExploitabilityScore":27,"ImpactScore":28},"nvd@nist.gov","Primary",{"Version":20,"VectorString":13,"AttackVector":21,"AttackComplexity":22,"PrivilegesRequired":23,"UserInteraction":24,"Scope":25,"ConfidentialityImpact":22,"IntegrityImpact":22,"AvailabilityImpact":22,"BaseScore":12,"BaseSeverity":22,"ExploitCodeMaturity":26,"RemediationLevel":26,"ReportConfidence":26,"TemporalScore":26,"TemporalSeverity":26,"ConfidentialityRequirement":26,"IntegrityRequirement":26,"AvailabilityRequirement":22,"ModifiedAttackVector":26,"ModifiedAttackComplexity":26,"ModifiedPrivilegesRequired":26,"ModifiedUserInteraction":26,"ModifiedScope":26,"ModifiedConfidentialityImpact":26,"ModifiedIntegrityImpact":26,"ModifiedAvailabilityImpact":26,"EnvironmentalScore":26,"EnvironmentalSeverity":26},"3.1","LOCAL","HIGH","LOW","NONE","UNCHANGED",null,1,5.9,[30],{"Source":17,"Type":18,"CVSSData":31,"BaseSeverity":34,"ExploitabilityScore":37,"ImpactScore":38,"ACInsufInfo":26,"ObtainAllPrivilege":26,"ObtainUserPrivilege":26,"ObtainOtherPrivilege":26,"UserInteractionRequired":26},{"Version":32,"VectorString":33,"AccessVector":21,"AccessComplexity":34,"Authentication":24,"ConfidentialityImpact":35,"IntegrityImpact":35,"AvailabilityImpact":35,"BaseScore":36,"BaseSeverity":26,"Exploitability":26,"RemediationLevel":26,"ReportConfidence":26,"TemporalScore":26,"CollateralDamagePotential":26,"TargetDistribution":26,"ConfidentialityRequirement":26,"IntegrityRequirement":26,"AvailabilityRequirement":26,"EnvironmentalScore":26},"2.0","AV:L\u002FAC:M\u002FAu:N\u002FC:C\u002FI:C\u002FA:C","MEDIUM","COMPLETE",6.9,3.4,10,0.01185,[39,39,39,39,39,39,39],"High",[43,48],{"vendor":44,"product":45,"version":46,"criteria":47,"vulnerable":4},"plex","media_server","*","cpe:2.3:a:plex:media_server:*:*:*:*:*:*:*:*",{"vendor":49,"product":50,"version":51,"criteria":52,"vulnerable":4},"microsoft","windows","-","cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*",2,[55,60,65,70],{"url":56,"source":57,"tags":58},"https:\u002F\u002Fbugsec.com\u002Fexperts_teams\u002F","Bugsec",[59],"Third Party Advisory",{"url":61,"source":62,"tags":63},"https:\u002F\u002Fforums.plex.tv\u002Ft\u002Fsecurity-regarding-cve-2021-42835\u002F761510","Plex",[64],"Vendor Advisory",{"url":66,"source":67,"tags":68},"https:\u002F\u002Fir-on.io\u002F2021\u002F12\u002F02\u002Flocal-privilege-plexcalation\u002F","Ir-on",[69,59],"Exploit",{"url":71,"source":62,"tags":72},"https:\u002F\u002Fwww.plex.tv\u002Fmedia-server-downloads\u002F",[73,64],"Product",4,[76],{"id":77,"name":78,"description":79,"extendedDescription":80,"status":81,"abstraction":82,"structure":83},"CWE-367","Time-of-check Time-of-use (TOCTOU) Race Condition","The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check. This can cause the product to perform invalid actions when the resource is in an unexpected state.","This weakness can be security-relevant when an attacker can influence the state of the resource between check and use. This can happen with shared resources such as files, memory, or even variables in multithreaded programs.","Incomplete","Base","Simple",false,[],{"title":87,"metaDescription":88,"keywords":89,"canonicalUrl":90,"structuredData":91},"What is CVE-2021-42835? Vulnerability Analysis | Security Advisory | EdgeProtect","Comprehensive analysis of CVE-2021-42835, a high severity cyber security vulnerability from 2021. An issue was discovered in Plex Media Server through 1.24.4...","CVE-2021-42835, CVE-2021-42835 vulnerability, CVE-2021-42835 security, high severity vulnerability, cybersecurity, vulnerability analysis, security advisory, CVE database, threat intelligence, security research, vulnerability assessment, cyber threats, 2021, CVSS score, exploit, patch, remediation, plex security, microsoft security, media_server vulnerability, windows vulnerability","\u002Fwhat-is\u002Fcve-2021-42835",{"@context":92,"@type":93,"headline":87,"description":88,"datePublished":10,"dateModified":11,"author":94,"publisher":98,"about":102,"mainEntityOfPage":106,"articleSection":109,"keywords":110},"https:\u002F\u002Fschema.org","TechArticle",{"@type":95,"name":96,"url":97},"Organization","EdgeProtect","https:\u002F\u002Fedgeprotect.io",{"@type":95,"name":96,"url":97,"logo":99},{"@type":100,"url":101},"ImageObject","https:\u002F\u002Fedgeprotect.io\u002Fimg\u002Flogos\u002Fedgeprotect-logo-512.png",{"@type":103,"name":6,"description":104,"additionalType":105},"Thing","Cybersecurity Vulnerability","https:\u002F\u002Fschema.org\u002FSoftwareBug",{"@type":107,"@id":108},"WebPage","https:\u002F\u002Fedgeprotect.io\u002Fwhat-is\u002Fcve-2021-42835","Cybersecurity","CVE-2021-42835, CVE-2021-42835 vulnerability, CVE-2021-42835 security, high severity vulnerability, cybersecurity, vulnerability analysis, security advisory, CVE database, threat intelligence, security research",[112],{"Operator":113,"Negate":26,"Nodes":114},"AND",[115,121],{"Operator":116,"Negate":26,"CPEMatch":117},"OR",[118],{"Vulnerable":4,"Criteria":47,"MatchCriteriaID":119,"VersionStartExcluding":26,"VersionStartIncluding":26,"VersionEndExcluding":120,"VersionEndIncluding":26},"4D655A8E-9991-48B9-950F-7DA9886B1227","1.25.0.5282",{"Operator":116,"Negate":26,"CPEMatch":122},[123],{"Vulnerable":26,"Criteria":52,"MatchCriteriaID":124,"VersionStartExcluding":26,"VersionStartIncluding":26,"VersionEndExcluding":26,"VersionEndIncluding":26},"A2572D17-1DE6-457B-99CC-64AFD54487EA",[],[127],{"id":128,"eventType":129,"eventTime":130,"details":131,"label":132,"color":133},"dfd37cd6-ba8d-49d1-ae59-6e56e151a326","LOW_EPSS_DELTA","2026-06-16T04:05:33.649477+00:00","Daily EPSS score decreased by 0.130 on 2023-12-30","EPSS Score Decreased","green",{"lastModified":11,"cacheTime":135,"version":32},1793386446667,{"score":137,"band":138,"action":139,"scoredAt":140},44,"Medium","Plan remediation","2026-10-30T06:53:08.57326+00:00"]