CVE-2021-20137: Gryphonconnect Gryphon Tower Firmware

Medium severity, CVSS 6.1. EPSS: 2.6% chance of exploitation in the next 30 days.

A reflected cross-site scripting vulnerability exists in the url parameter of the /cgi-bin/luci/site_access/ page on the Gryphon Tower router's web interface. An attacker could exploit this issue by tricking a user into following a specially crafted link, granting the attacker javascript execution in the context of the victim's browser.

Affected products

• Gryphonconnect Gryphon Tower Firmware: up to and including 04.0004.12

Published 2021-12-09. Last modified 2026-06-17.