PatchTheCVECVE-2021-38703: Wireless devices running certain Arcadyan-derived firmware (such as KPN Experia WiFi 1.00.15) do not properly
CVE-2021-38703 is a high-severity flaw (CVSS 8.8) affecting experia wifi firmware. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Wireless devices running certain Arcadyan-derived firmware (such as KPN Experia WiFi 1.00.15) do not properly sanitise user input to the syslog configuration form. An authenticated remote attacker could leverage this to alter the device configuration and achieve remote code execution. This can be exploited in conjunction with CVE-2021-20090.
Why this priority
- High severity
- EPSS top 9%: very likely to be exploited
- Public exploit reference
No fix is published yet: follow the downgrade or mitigation steps.
Risk facts
| CVSS score | 8.8 (High) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | Low |
| User interaction | None |
| EPSS exploit chance | 4.3% (top 9%) |
| CISA exploited list | No |
| Published | 2021-09-01 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2021-38703?
experia wifi firmware: mitigate or apply the listed mitigation. Exact commands for each OS are on this page.
Is CVE-2021-38703 being exploited?
CVE-2021-38703 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2021-38703 affect?
CVE-2021-38703 affects experia wifi firmware. Severity is high (CVSS 8.8). Wireless devices running certain Arcadyan-derived firmware (such as KPN Experia WiFi 1.00.15) do not properly sanitise user input to the syslog configuration form. An authenticated remote attacker could leverage this to alter the device con
How urgent is CVE-2021-38703?
Priority 59/100. High severity; EPSS top 9%: very likely to be exploited; Public exploit reference