CVE-2021-33963: Chinamobile An Lianbao Wf-1 Firmware

Critical severity, CVSS 9.8. EPSS: 3.1% chance of exploitation in the next 30 days.

China Mobile An Lianbao WF-1 v1.0.1 router web interface through /api/ZRMacClone/mac_addr_clone receives parameters by POST request, and the parameter macType has a command injection vulnerability. An attacker can use the vulnerability to execute remote commands.

Affected products

• Chinamobile An Lianbao Wf-1 Firmware: version 1.0.1 only

Published 2022-01-15. Last modified 2026-06-17.