External risk intelligence

SerComm AG Combo VD625 CRLF Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2021-27132

The affected product is a router/gateway device. Such devices are commonly deployed at the network edge to provide internet connectivity, making their management interfaces or web-based functions frequently reachable from the internet in standard residential and small business deployments.

Sercomm Agcombo Vd625 Firmware

agsot_2.1.0

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability affects SerComm AG Combo VD625 devices, allowing attackers to inject commands through a CRLF injection flaw in the download function. This could potentially lead to significant compromise of the affected devices. The main concern is confirming relevance and exposure.

Injects commands into device downloads.
Affects network edge devices used for connectivity.
Confirm relevance and exposure of affected devices.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending a specially crafted request to a device's download function. This function is exposed via HTTP and vulnerable to CRLF injection due to how it handles the `Content-Disposition` header. Successful injection allows an attacker to inject arbitrary HTTP headers, potentially leading to unauthorized access or control.

No authentication or special access needed.
Triggered by crafting `Content-Disposition` header.
Risk of unauthorized header injection.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to inject malicious HTTP headers into the device's download function. When supported by the advisory, this could affect the device's service behavior and potentially expose system data.

Device configuration and system data.
Via a crafted HTTP request to the download function.
May lead to unauthorized information disclosure.

Operational Fix

Recommended remediation, mitigation, and detection steps

For CVE-2021-27132, ownership likely falls to infrastructure or network teams managing edge devices. The first actionable step is to identify all deployed instances, determine their internet reachability and business criticality, and then confirm the accountable owner before planning remediation.

Identify and confirm owner for devices.
Verify internet reachability and criticality.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the SerComm AG Combo VD625?

The SerComm AG Combo VD625 is a router and gateway device. These units are typically deployed at the network edge by service providers to manage internet connectivity for residential or small business environments, acting as a bridge between a local network and the internet.

How does CRLF injection work in CVE-2021-27132?

This vulnerability falls under the CWE-74 weakness class, which involves improper neutralization of special elements. In this specific case, the device fails to properly filter input within the Content-Disposition HTTP header. An attacker can use special carriage return and line feed (CRLF) characters to break out of the intended header structure, allowing them to inject unauthorized HTTP headers into the server's response.

Do I need to authenticate to trigger this flaw?

No. The vulnerability exists within the device's download function, which handles incoming HTTP requests. An attacker does not need prior authentication or specific credentials to send a crafted request. However, simply browsing the device's main page or using standard, legitimate functions without a malicious header payload will not trigger this specific injection vulnerability.

Why is this CVE concerning for my network?

According to Halo Surface Signal, this product acts as a network edge device, meaning its management or web-based functions are often exposed directly to the internet. Because it is reachable from the outside, any unauthenticated user on the internet may have the potential to interact with the vulnerable download function, making it a high-priority item for devices not protected by additional layers.

How should I respond to CVE-2021-27132?

Start by performing an inventory to locate all deployed AG Combo VD625 units within your environment. Once identified, verify which devices are accessible from the internet versus those kept on internal-only segments. Determine the business criticality of these gateways and coordinate with the network team to ensure you have a clear plan for applying updates or restricting remote access to the management interfaces.

References

cybertuz.com/blog/post/crlf-injection-CVE-2021-27132

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.