Security readout for executives and security teams
Plain-English summary
CVE-2021-4480 affects Dräger Protector Software before version 6.4.2. Weak file permissions can let a local attacker replace program files or modules and gain NT SYSTEM-level execution. This is serious where the software runs on shared or user-accessible hosts.
Executive priority
Treat as high priority for environments using Dräger Protector Software, especially where multiple users can access the host. Patch or remove exposure promptly, but do not assume active exploitation from the supplied evidence.
Technical view
The issue is CWE-732: incorrect permission assignment for a critical resource. Local attackers can abuse writable binaries or loaded modules to execute arbitrary code with elevated privileges. The CVSS 4.0 score is 8.3, with local attack vector, low complexity, and high integrity and availability impact.
Likely exposure
Exposure is likely limited to hosts running Dräger Protector Software earlier than 6.4.2. The bundle does not identify additional Dräger products, deployment types, or internet-facing exposure.
Exploitation context
The CVE is not listed as KEV in the provided bundle, and the cited sources do not state active exploitation. The attacker must have local access and the condition depends on insecure filesystem permissions.
Researcher notes
The source bundle states versions before 6.4.2 are affected, but the structured affected record is sparse and lists version "0" with defaultStatus "unaffected." Use vendor data as the authority for final scoping.
Mitigation direction
- Upgrade Dräger Protector Software to version 6.4.2 or later where applicable.
- Review the Dräger advisory for supported remediation and deployment guidance.
- Restrict local access to affected hosts until remediation is complete.
- Monitor affected installation paths for unexpected binary or module changes.
Validation and detection
- Inventory systems for Dräger Protector Software and record installed versions.
- Confirm affected systems are not running versions earlier than 6.4.2.
- Review installation directory permissions for non-administrative write access.
- Check endpoint logs for unusual changes to Protector binaries or modules.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-732: Authorization and privilege behavior lookup
Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupExecution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupPrivilege behavior lookup
The CVE wording references privilege impact, so privilege escalation and authorization behavior review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2021-4480 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.3 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H——VulnCheckCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:H1.85.8VulnCheckVulnerability scoring details
Base CVSS 4.0 score
8.3HighVector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H
Base CVSS 3.1 score
8.2HighVector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://static.draeger.com/security/download/2021-267-01-Draeger-Protector-Software-vulnerabilities.pdfCVE reference, VulnCheck · vendor-advisory
- https://www.vulncheck.com/advisories/dr-ger-protector-software-local-privilege-escalation-via-insecure-file-permissionsCVE reference, VulnCheck · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.