Security readout for executives and security teams
Plain-English summary
CVE-2021-36797 reports that Victron Energy Venus OS through 2.72 grants root access by default to someone with physical device access. This is primarily a physical-access risk, not a documented remote compromise. The vendor disputes the reporter's security-best-practice claim.
Executive priority
Treat this as a situational operational risk, highest where devices are in shared, customer-accessible, or uncontrolled locations. Do not assume remote exploitability from the available evidence.
Technical view
The CVE record describes default root access on Venus OS through 2.72 when an actor has physical access. No CVSS score, CWE, CPE, patch, or named mitigation is provided in the source bundle. The only referenced technical discussion is the Victron GitHub issue.
Likely exposure
Exposure appears limited to organizations using Victron Energy Venus OS devices through 2.72 where unauthorized people can physically reach the hardware. Evidence is insufficient to identify exact models, configurations, or later-version status.
Exploitation context
The source bundle does not show known active exploitation, and the CVE is not marked as CISA KEV. The described condition requires physical access, which changes urgency toward site security, tamper control, and operational risk review.
Researcher notes
The record is sparse and includes vendor disagreement. Avoid expanding scope beyond Venus OS through 2.72 without vendor confirmation. Key gaps are affected hardware mapping, configuration dependency, severity scoring, and authoritative remediation status.
Mitigation direction
- Check Victron guidance and issue 836 before making operational changes.
- Restrict physical access to affected Victron Venus OS devices.
- Review whether default root access is acceptable for deployed environments.
- Update device software only according to vendor-supported guidance.
Validation and detection
- Inventory Victron Venus OS devices and record their OS versions.
- Confirm whether any devices run Venus OS 2.72 or earlier.
- Review physical access controls for each device location.
- Document compensating controls where software guidance is unavailable.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2021-36797 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/victronenergy/venus/issues/836CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.